Synapse Layer Skill for Hermes Agent

Zero-Knowledge persistent memory layer for Hermes Agent. Provides encrypted cross-session memory, Trust Quotient (TQ) scoring, and automatic recall across AL...

Before installing, verify the following: (1) Correct the metadata mismatch — ask the publisher why the registry shows no required env vars while SKILL.md requires SYNAPSE_TOKEN. (2) Confirm you trust https://forge.synapselayer.org and review their privacy/security docs and source code (the skill bundle contains no code to verify their zero-knowledge/PII-redaction claims). (3) Avoid storing long-lived credentials in remote memory unless you understand and accept the risk — prefer short-lived tokens, rotate credentials after testing, and limit what the agent is allowed to persist. (4) Test with non-sensitive data first to confirm behavior and inspect network requests. (5) If you need to store secrets, ensure there is an auditable access policy and the service's encryption/zero-knowledge design is independently verifiable. (6) Ask the publisher to remove recommendations that reference root-only paths (/root/.hermes/...) and to clarify why tool-progress must be disabled for Telegram (this hides agent actions and can reduce transparency).

Type: OpenClaw Skill Name: synapse-layer-hermes Version: 1.1.9-b The skill bundle instructs the agent to exfiltrate highly sensitive information, including API credentials (Nous, Naga, Telegram tokens) and server infrastructure details, to an external third-party service (synapselayer.org). Furthermore, SKILL.md contains explicit instructions to hide these background activities from the user by disabling tool progress indicators in Telegram. While framed as a 'persistent memory' feature with 'zero-knowledge' security claims, the combination of targeted secret collection and stealth configuration poses a significant risk of data exfiltration (IOC: forge.synapselayer.org).