{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"79069404-3e3e-4d79-9e4f-0011da8de47b","kind":"skill:site-content-check","nodes":[{"acceptedSubmissionHash":"e45a326179842e49072ddb97f5dd714feccade4391563db9f5c702c895494e58","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"9724d22ee4afab47bcc23d9bcd121784b0de277f78f82806d4dc4e8aa62609bf","skillId":"site-content-check","tools":[]},"key":"site_content_check","kind":"code","role":"review","skillHash":"9724d22ee4afab47bcc23d9bcd121784b0de277f78f82806d4dc4e8aa62609bf","skillId":"site-content-check","state":"accepted"}],"objective":"The scoreboard of the IMD swarm's unofficial judging of the Hermes Agent Plugin Hackathon. It is finished: host the files as committed, with no changes.","parentJobId":null,"planHash":"8cd7322aaaf3bd98ac7892721c67a1c8e74ae9428dfe510f64dea85654c28062","previousHash":"ee44e8fb910640f1e00ae9c372aa7195970b608c7ac09ea723b9a23dc0209384","projectId":"79069404-3e3e-4d79-9e4f-0011da8de47b","publication":{"commit":null,"deliveredAt":null,"repoUrl":null},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[],"site":{"cid":"bafybeih2eq32n5f4wtryadb3cfwq3vhg2tggww34akeduognswgs4xihkm","ensName":"hermes-hackathon.identitymd.eth","namingTransaction":"0x4ea4bc89422ff89d93bd39b19bbfcc6304057582b2fc03e23060c1bbc2bc0e46"},"snapshotHash":"07d7198aee23b5a33ca2ee667223932f1cce6ea68388ddbe7eef42e494611da4","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"273e2f46918e7b5e","findings":[{"citation":"resolved","description":"route() decodes the hash with decodeURIComponent without a try/catch. A hash such as #/p/%E0 (an invalid UTF-8 escape) makes decodeURIComponent throw URIError, so route() aborts: on first load the error escapes start() as an unhandled rejection after the list has painted, and on a later hashchange the listener throws. No sheet opens and no message is shown. The list itself keeps working, so this is advisory, not a hosting blocker. A try/catch around the decode, treating a bad hash as 'no card', would fix it.","line":186,"path":"app.js","reproduction":"Serve the folder (python3 -m http.server 8766) and open http://127.0.0.1:8766/#/p/%E0. Expected: the board loads and the bad hash is ignored. Actual: the board loads, then the console shows 'URIError: URI malformed' from route() in app.js; the same error appears if, on a loaded page, you set location.hash = '#/p/%E0'. Plain Node confirms the throw: node -e 'decodeURIComponent(\"%E0\")'.","severity":"low","snippet":"    const r = m && state.rows.find((x) => x.slug === decodeURIComponent(m[1]));","title":"Malformed percent-encoding in the scorecard hash throws an uncaught URIError and stops routing"},{"citation":"resolved","description":"Everything else on the page says whose judging this is: the h1, og:title and twitter:title read 'IMD judged the Hermes plugin hackathon', the meta description and lede say 'Unofficial', the footer carries the disclosure, and no Nous Research logo or look is used, so this is not impersonation. But the only text a no-JavaScript reader, a crawler, or a bookmark sees before app.js runs is the bare title 'Hermes Hackathon'; the comment at app.js line 7 says IMD also names the site after this title. Adding 'IMD' or 'unofficial' to the static title would remove the ambiguity. Advisory.","line":6,"path":"index.html","reproduction":"Fetch index.html without running scripts (curl http://127.0.0.1:8766/ | grep '<title>') or view the tab title with JavaScript disabled. Expected: a title that names IMD or says unofficial, like the h1. Actual: '<title>Hermes Hackathon</title>'; the full title is only set at app.js line 9 after the script runs.","severity":"low","snippet":"<title>Hermes Hackathon</title>","title":"Static <title> is just 'Hermes Hackathon' with no IMD or 'unofficial' marker"},{"citation":"resolved","description":"face() builds an <img> whose src is https://github.com/<author>.png?size=96 for each row painted and for the open scorecard, so a visitor's browser contacts github.com (lazy-loaded, 100 rows a page). The URL only carries the entrant's public GitHub login, nothing about the visitor beyond the request itself. No tracking script is present anywhere on the site; this is noted because the page does not disclose the third-party fetch. Advisory.","line":38,"path":"app.js","reproduction":"Open the page with the network panel open. Expected: requests to the site's own origin only, or a note that avatars come from GitHub. Actual: one request per shown row to https://github.com/<author>.png?size=96, for example https://github.com/RaYYeR220.png?size=96 for rank 1.","severity":"info","snippet":"  const face = (author, size) => h(\"img\", { class: \"face\", src: `https://github.com/${encodeURIComponent(author || \"ghost\")}.png?size=96`, alt: \"\", width: size, height: size, loading: \"lazy\", decoding: \"async\" });","title":"Every visible row fetches the author's avatar from github.com, a third-party request the page does not mention"},{"citation":"resolved","description":"data/board.json has counts.ran = 128 (108 rows with tier 'ran' plus 20 'final'), the disclosure in the same file says Summon 'finished 73rd of the 128 there', and the page's 'How it was judged' step 3 renders 'The best 128 run inside real Hermes.' from that count. README.md line 11 alone says 129. If the tree is pinned as committed, README.md is served alongside the page with a number that contradicts it. Advisory.","line":11,"path":"README.md","reproduction":"Compare README.md line 11 ('the best 129 run inside real Hermes') with data/board.json counts ('ran': 128) and the rendered step 3 on the page. Expected: the same number in all three. Actual: README says 129, the data and the page say 128; counting rows with tier 'ran' or 'final' in board.json gives 128.","severity":"low","snippet":"- Four rounds by IMD's AI agents: every plugin read once, the top 240 read again, the best 129 run inside real Hermes by three agents each, and 20 finalists ranked against each other by 11 agents.","title":"README says 129 plugins were run inside Hermes; the data, page and disclosure say 128"}],"hash":"e45a326179842e49072ddb97f5dd714feccade4391563db9f5c702c895494e58","nodeId":"768dc61f-b30e-4895-81bb-6b98cd6b42f0","outcome":"completed","summary":"The review is complete and the site is clear to host. Nothing critical or high was found. The findings file holds four advisory items.\n\n**What was read.** Every file that will be served: the page, the script, the stylesheet, the favicon, the share image, the README, and all seventeen JSON data files, 2.5 MB in total. The script was also run end to end under jsdom against the real data, since Chromium cannot launch on this machine without root-installed libraries.\n\n**Why it is safe to host.**\n- The script sets all entrant and agent text as text nodes, never as HTML. The only innerHTML use draws from a fixed set of inline SVG icons.\n- No third-party script, iframe, redirect, wallet code, miner or obfuscated code exists. The only outbound requests are GitHub avatar images and links the visitor clicks.\n- Every link in the data is https and points at github.com, gitlab.com, x.com, YouTube, or IMD's own explorer and API hosts. No javascript: or data: URLs appear anywhere.\n- Scanning all text for seed phrase, private key or password solicitations, slurs, sexual or violent content, credentials, and hidden Unicode found only agents describing plugins' security behaviour.\n- The data is internally consistent: 1,464 rows, 1,454 ranked with contiguous ranks and scores that sort with rank, score bands matching the stated tiers, tag counts matching, and a detail entry for every row. The disclosure about Summon checks out at 73rd of 128. The share image's top five match the data.\n- Impersonation does not apply. The page carries IMD's own mark, no Nous logo, and says unofficial in the lede, meta description, share text and footer. The hackathon is a real Nous Research event that ended November 11.\n\n**Advisory findings written to the file.**\n- Low, app.js line 186: a hash with a malformed escape such as #/p/%E0 throws an uncaught URIError and stops card routing. Confirmed under jsdom on both fresh load and hash change. The board keeps working.\n- Low, index.html line 6: the static title is just \"Hermes Hackathon\" with no IMD or unofficial marker, and the script comment says IMD names the site after it. All other surfaces are clearly labelled.\n- Info, app.js line 38: each shown row fetches the author's avatar from github.com, an undisclosed third-party request carrying only the entrant's public login.\n- Low, README.md line 11: it says 129 plugins were run inside Hermes, while the data, page and disclosure say 128.\n\n**Not verified.** A real browser render of layout and animations was not possible here. The claim that Nous counts nearly 1,000 entries could not be checked against a public source.\n\nSources: [Coinfomania on the Hermes plugin hackathon](https://coinfomania.com/nousresearch-launches-hermes-agent-plugin-hackathon-offering/)","treeHash":null,"usage":{"cachedInputTokens":521116,"cost":{"source":"runtime","usdMicros":2506201},"inputTokens":322,"model":"claude-fable-5-1","outputTokens":20889,"runtime":"claude","turns":18,"wallClockMs":311507}}],"verification":[]}