SHL0MS just open-sourced UNBROKER, a Hermes Agent skill that hunts down your personal info on data broker sites and files the removal requests. It’s free, it runs on your own machine, and it automates the same workflow that DeleteMe charges $129 to $499 a year for.
UNBROKER runs as a native Hermes Agent skill. That means it uses the agent’s browser, email, and scheduling tools to do the work. You tell it who you are, give it consent, and it fans out across hundreds of broker sites. It files opt-outs under the right legal framework for your jurisdiction and hands you a digest of anything that needs a human touch.
The data broker problem is worse than most people realize
Hundreds of data brokers publish your name, current and former addresses, phone numbers, email addresses, birthdays, and even your relatives’ names. Anyone with $5 and a search bar can find where you live in about ten seconds.
Laws like CCPA, CPRA, and GDPR say a broker has to delete your data if you ask. The catch: there is no bulk button. Every broker runs a different opt-out process, and many make it intentionally difficult. One wants a phone call. Another demands a fax. A third buries the form behind three redirects and a CAPTCHA.
This is the entire business model for DeleteMe (from $129/year for one person), Incogni, and EasyOptOuts. They charge you a subscription to file removals you can legally submit yourself for free. And while they do the work, you’re also handing a new company the exact data you’re trying to erase.
How UNBROKER works
UNBROKER takes a different approach. It’s a local-first tool that runs inside your own Hermes Agent instance. Here’s what happens after you run it:
First, it builds search vectors from everything: every name, alias, email, phone number, and address you’ve ever had. Brokers might index you under a maiden name or a house you left in 2014. The naive approach of searching your current name plus current city misses those profiles. UNBROKER searches across all of them.
Then it fans out parallel sub-agents across the broker list. That list pulls from a maintained public source (the BADBOOL list by Yael Grauer) and the California Data Broker Registry. The registry alone covers roughly 545 registered brokers. For California residents, there’s also the DROP portal, a single verified request that deletes your data from every registered broker at once.
The automation runs in tiers. When UNBROKER can handle a broker end-to-end, it drives a browser through the opt-out form, sends the email, and opens the confirmation link. Soft CAPTCHAs clear on their own with a real browser. Hard interactive challenges (government ID uploads, phone callbacks) escalate to a short human-task digest at the end.
UNBROKER tailors every request to your jurisdiction. If you live in California, it files under CCPA and CPRA. If you’re in the EU or UK, it uses GDPR. Everywhere else gets a general right-to-delete request. It never cites a legal right you can’t invoke.
Privacy by default
I’m calling out the privacy design because it’s the thing commercial services can’t offer: your data never has to leave your machine.
You can encrypt dossiers at rest. Opaque IDs keep your real name out of every filename and log. UNBROKER won’t submit anything to a broker until it confirms a real listing exists and validates the match is actually you, not a namesake or relative. It sends only the exact fields a broker requires and never volunteers SSN or ID numbers.
For email, it doesn’t need a stored password. It can send opt-outs and open verification links through your own logged-in webmail, or you can wire up SMTP. If you don’t configure either, it falls back to writing drafts for you to send manually.
The catch
UNBROKER is v1.0 and ships with 85 hermetic tests. The deterministic engine, the autonomous loop, and the broker-registry coverage all check out. Live agent-driven submission against broker sites is the active field-testing frontier.
The scope is US-first. EU, UK, and global coverage sit on the roadmap, but the current broker list and automation focus on US-based people-search sites and state registries. If you’re outside the US, your mileage will vary.
Brokers also relist you eventually, or new ones find your data. UNBROKER handles this with a ledger that tracks every case and a cron-based re-scan schedule. That means the problem is never truly solved. Data removal is maintenance, not a one-time fix.
And it requires Hermes Agent. If you’re not already running it, you need to set that up first. That’s a real barrier, but Hermes Agent itself is free and open-source. And this is the kind of task where running the tool locally and keeping your data off someone else’s server is the whole point.
This is the right model for sensitive automation
Some tools should never be cloud services. Anything that touches your passwords, your finances, or your personally identifiable information belongs on your own machine where you can inspect what it does.
Data broker removal sits squarely in that category. The commercial services owned this space because the work is high-volume and the broker landscape shifts constantly. UNBROKER proves an agent-native approach can handle the same workload. No subscription, no third-party data handoff, no black box.
SHL0MS announced UNBROKER on X on July 3, and the repo is live now under the NousResearch GitHub organization. The skill installs with a single command: hermes skills install official/security/unbroker.
I’ve covered Hermes Agent’s recent releases and its growing skill ecosystem, but UNBROKER is the first skill I’ve seen that directly replaces a paid SaaS subscription with a local agent workflow. If this pattern holds, and I think it will, expect to see a lot more tools that look like this.
