Cairn
NousResearch/hermes-agent

False positive: env-var name mistaken for hardcoded secret

Cluster 116221. Data as of

Nothing open on GitHub. Fix merged in #116875 on 20 Sep 2026. Check it covers your case.

The short answer

0open issues
0open PRs
4items grouped
Known?
Yes. 4 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #116875. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PR #116875. That is separate from the fix event.
Still open
Nothing open on GitHub.

These issues and PRs address a false positive where a string constant holding the *name* of an environment variable was incorrectly flagged as a hardcoded secret, blocking plugin installation. The fixes aim to distinguish env-var name literals from actual embedded credentials.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #116875 fix(guard): an env-var NAME constant no longer blocks a plugin install as a hardcoded secret (#116221, salvage #116231)

    merged to main

    files: tests/tools/test_plugin_guard.py, tests/tools/test_threat_patterns.py, tools/plugin_guard.py, tools/skills_guard.py, tools/threat_patterns.py

2 PRs closed without merging

From the close comments: done elsewhere 1 · merged via another change 1

  • #116231 fix(skills): an env-var NAME constant is not an embedded credential · merged via another change → 3d14b20, #116875, #116221, #116231
  • #117517 fix(plugin-guard): treat an env-var NAME literal as public, not a hardcoded secret (#116221) · done elsewhere → 1b50e99, #116221, #116875, #116231
Closed issues · 1
  • Closed#116221plugin_guard: hardcoded_secret false positive on constants holding the NAME of a credential env var (blocks install, --force cannot override)
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Merged PRs
#116875
Closed issues
1
Attempts
2 PRs closed without merging
Fix link checked
20 Sep 2026

For your agent

The same facts, typed.

cluster/116221.json
cluster/116221.md