Hermes plugin · runtime guard
Scanner → enforcement → flight recorder.
Hermes agents browse the web, read files, and run commands — everything those tools return is untrusted. The elcaro plugin scans every tool result before it reaches the model, replaces quarantined content in place, and writes a hash-chained, Ed25519-signed trail of every verdict. Detection is a feature; the trail is the product.
Enforcement happens inside the turn
transform_tool_result
Primary lever. Every tool result is scanned before it's appended to conversation; quarantined content is swapped for a signed [CONTENT QUARANTINED] notice — the injection never reaches the model.
pre_tool_call
The args lane. write_file / terminal arguments are scanned too, so a model pasting fetched content into a heredoc can't smuggle the payload past the result scan — or persist poison into the repo.
pre_llm_call
Backstop. A once-per-turn summary of new quarantines so the agent doesn't retry the fetch or work around withheld content.
3 quarantined / 41 scanned · 38 signed · 1 propagation
◉ honeypot sprung — 1 exfiltration attempt caught
HONEYPOT · decoy_exfiltration · signed
canary elcaro:ipi:7f3a… minted by 9c1e44ab21… (scored 0.91) resurfaced in write_file
quarantined · authority_framing, delimiter_escape · signed
▸ signed receipts (38) — clean scans, verifiable offline
What no prompt or skill could produce
Provenance edges
When a canary minted by an earlier scan resurfaces inside new content — another tool result, another session, a write_file payload — the log records an edge: token → origin scan → this scan. The pane shows the injection's propagation path, not just its arrival.
Decoy honeypot
A service-credentials.env bait file with an installation-unique ELCARO-DECOY-* marker sits in the plugin data dir. The marker inside any scanned result or tool-args payload is a deterministic 1.00 quarantine — proof of exfiltration-in-progress, zero false positives.
Tamper-evident log
Every entry carries prev_hash → entry_hash over the canonical verdict. /elcaro verify and the pane's chain badge recompute the whole chain — a flight recorder that notices when someone edits the tape.
Signed receipts
When a signing key is configured, every verdict — including clean scans — is Ed25519-signed over content SHA, score, and timestamp. 'The agent acted because elcaro signed off' becomes a verifiable artifact.
Time-shifted verdicts
elcaro_explain reads the same log as a forensic tool: identical bytes scored differently across time means enforcement changed; the same source hashing differently means the page changed.
/elcaro calibrate
Replays the seeded attack & benign corpus in-session — run the attack against yourself and watch the scores land, live in the pane.
Commands
| /elcaro | recent verdicts & quarantine count, in-session |
| /elcaro <index> | explain a logged verdict — including its verdict history |
| /elcaro calibrate | replay the seeded attack corpus against yourself |
| /elcaro verify | recompute the hash chain — tamper check |
| hermes elcaro log|status|calibrate|verify | the same trail from the CLI |
Fully local: deterministic engine, sub-10 ms verdicts, no network by default. Content never leaves the box — only its SHA-256 is logged. Source →