Begin with the listing’s review status
- Confirm the public repository and exact commit linked by the Registry. A commit is a fixed source version.
- Check whether anyone installed and tested that exact version. Look for the Hermes version, computer system, date, steps, and result.
- Read the required accounts, file access, tools, outside connections, schedules, and known limitations.
- Treat the project publisher’s description as untested until a recorded test reproduces it.
Read instructions and code that can cause actions
Review the files that can guide the Bot or trigger actions. Pay special attention to instructions that reveal credentials, change other profiles, disable safeguards, send data, install software, or make permanent changes.
- SOUL.md contains the Bot’s continuing role instructions.
- Skills contain instructions for specific tasks.
- Scripts and setup commands can run work on the computer.
- Model Context Protocol (MCP) settings can connect the Bot to outside tools or accounts.
- Scheduled-task files can make work run automatically.
- Public files still require review for safety, maintenance, compatibility, and accurate documentation.
Check which repository files Hermes may copy
The package file, distribution.yaml, can name the files that Hermes may copy into a profile.
- Find distribution_owned, the list of files that belong to the package.
- Confirm that every listed path belongs in the new profile.
- Review the exact project version before installation.
- If the list is missing or empty, the released v0.20.5 code may copy most files from the top level of the repository.