Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documentation-only guide for configuring Hermes to use user-chosen OpenAI-compatible LLM providers, with expected network and credential handling for that purpose.
Before installing, understand that using this skill can reconfigure Hermes so your prompts, model traffic, and API costs go to a chosen third-party or self-hosted provider. Only enter API tokens for providers you trust, review the final Hermes config after changes, and keep backups when migrating profiles or auxiliary tasks.
format: ```bash curl -s --request POST \ --url "https://your-endpoint/v1/chat/completions" \ --header "Authorization: Bearer $TOKEN" \ --header "Content-Type: application/json" \
Hit the provider's OpenAI-compatible model list endpoint: ```bash curl -s https://opencode.ai/zen/v1/models | python3 -m json.tool ``` This returns every model the provider serves. The alias will be in the
format: ```bash curl -s --request POST \ --url "https://your-endpoint/v1/chat/completions" \ --header "Authorization: Bearer $TOKEN" \ --header "Content-Type: application/json" \
inference. It exposes an **OpenAI-compatible** endpoint at:
```
https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/ai/v1
```
This means Hermes can use it via `provider: custom` with no plugin.inference. It exposes an **OpenAI-compatible** endpoint at:
```
https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/ai/v1
```
This means Hermes can use it via `provider: custom` with no plugin.inference. It exposes an **OpenAI-compatible** endpoint at:
```
https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/ai/v1
```
This means Hermes can use it via `provider: custom` with no plugin.inference. It exposes an **OpenAI-compatible** endpoint at:
```
https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/ai/v1
```
This means Hermes can use it via `provider: custom` with no plugin.inference. It exposes an **OpenAI-compatible** endpoint at:
```
https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/ai/v1
```
This means Hermes can use it via `provider: custom` with no plugin.`@cf/...` prefixed IDs:
```bash
curl -s --request POST \
--url "https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/ai/v1/chat/completions" \
--header "Authorization: Bearer ${API_TOKEN}" \
--header "Content-Type: application/json" \```bash
# Find the default branch
curl -s https://api.github.com/repos/anomalyco/opencode \
| python3 -c "import json,sys; print(json.load(sys.stdin).get('default_branch','unknown'))"
# → "dev" (not "main")
``````bash
# Find the default branch
curl -s https://api.github.com/repos/anomalyco/opencode \
| python3 -c "import json,sys; print(json.load(sys.stdin).get('default_branch','unknown'))"
# → "dev" (not "main")
```No suspicious patterns detected.