The Skills Hub is a user-driven discovery and installation system for extending Hermes Agent capabilities. It connects to multiple registries—including official optional skills, GitHub repositories, the skills.sh marketplace, and ClawHub—and provides a unified interface for searching, installing, and managing skills. tools/skills_hub.py3-14
Key Principle: The Skills Hub is exclusively user-operated. Agents cannot autonomously install, modify, or delete skills from the hub. Users manage the library via the hermes skills CLI or /skills slash commands. hermes_cli/skills_hub.py3-11
Security Model: Every skill from an external source is passed through the Skills Guard scanner. Dangerous patterns (e.g., data exfiltration, prompt injection, destructive commands) trigger blocks or require explicit user overrides based on the source's trust level. tools/skills_guard.py3-9
The Skills Hub architecture bridges the gap between remote registries and the local ~/.hermes/skills/ directory.
Skills Hub System Architecture
Sources: tools/skills_hub.py3-14 hermes_cli/skills_hub.py3-11 tools/skills_guard.py3-23 tools/skills_hub.py69-99 tools/skills_hub.py1010-1030 tools/skills_hub.py1060-1070
Skill Resolution Data Flow
This diagram illustrates how a user-provided short name (e.g., "pptx") is resolved to a specific code entity (a SkillBundle) and eventually written to the SKILLS_DIR.
Sources: hermes_cli/skills_hub.py49-95 hermes_cli/skills_hub.py126-153 tools/skills_hub.py1145-1155 tools/skills_hub.py1060-1070 tools/skills_guard.py330-340 tools/skills_guard.py51-61 tools/skills_hub.py844-900
Key Code Entities:
| Entity | File | Role |
|---|---|---|
SkillSource | tools/skills_hub.py24 | Abstract base class for all skill registry adapters. |
GitHubAuth | tools/skills_hub.py172 | Manages GitHub API tokens via env vars, gh CLI, or Apps. |
HubLockFile | tools/skills_hub.py844 | Tracks the source, hash, and version of installed hub skills. |
SkillMeta | tools/skills_hub.py131-141 | Minimal metadata returned by search results. |
SkillBundle | tools/skills_hub.py145-153 | Container for downloaded skill files and metadata. |
TapsManager | tools/skills_hub.py903 | Manages user-added GitHub repositories ("taps"). |
Sources: tools/skills_hub.py24 tools/skills_hub.py131-141 tools/skills_hub.py145-153 tools/skills_hub.py172-200 tools/skills_hub.py844-900 tools/skills_hub.py903
The hub uses a pluggable adapter system to fetch skills. The create_source_router function initializes the active adapters. tools/skills_hub.py1145-1155
The GitHubSource fetches skills from any GitHub repository using the Contents API. tools/skills_hub.py307-310
GitHubAuth, prioritizing GITHUB_TOKEN or gh auth token. tools/skills_hub.py172-178openai/skills, anthropics/skills, huggingface/skills, and NVIDIA/skills are automatically marked as trusted. tools/skills_guard.py40-49skills.sh.json grouping sidecars to surface provider labels and categories in search results. tests/tools/test_skills_hub.py80-86 This is handled by _parse_skillsh_groupings and _get_skillsh_groupings within GitHubSource. tests/tools/test_skills_hub.py92-152SkillsShSource acts as a proxy for the skills.sh marketplace. tools/skills_hub.py537-540 It searches the marketplace index and delegates the actual file fetching to GitHubSource once the underlying repository is identified. tools/skills_hub.py623-630
ClawHubSource connects to the ClawHub API to search and fetch skills, supporting both search endpoints and exact slug lookups. tools/skills_hub.py656-665LobeHubSource fetches a remote JSON index of skills and filters them based on the query. tools/skills_hub.py461-470OptionalSkillSource provides access to the optional-skills/ directory included in the Hermes repository. tools/skills_hub.py245-250 These are considered builtin and bypass standard security scanning. tools/skills_guard.py52-53 Official optional skills are not active by default and must be installed via hermes skills install official/<category>/<skill>. website/docs/reference/optional-skills-catalog.md9-13
Sources: tools/skills_hub.py245-250 tools/skills_hub.py307-310 tools/skills_hub.py461-470 tools/skills_hub.py537-540 tools/skills_hub.py623-630 tools/skills_hub.py656-665 tools/skills_guard.py40-49 tools/skills_guard.py52-53 tests/tools/test_skills_hub.py80-86 tests/tools/test_skills_hub.py92-152 website/docs/reference/optional-skills-catalog.md9-13
The Skills Guard system performs static analysis on every downloaded skill. tools/skills_guard.py3-9
The scan_skill function iterates through all files in a downloaded bundle. tools/skills_guard.py330-340
curl with env vars tools/skills_guard.py103-105), prompt injection (e.g., "ignore previous instructions" tools/skills_guard.py180-182), and destructive commands. tools/skills_guard.py98-179safe, caution, or dangerous. tools/skills_guard.py280-289The INSTALL_POLICY determines if a skill can be installed based on its trust_level and verdict. tools/skills_guard.py51-61
| Trust Level | Safe | Caution | Dangerous |
|---|---|---|---|
builtin | Allow | Allow | Allow |
trusted | Allow | Allow | Block |
community | Allow | Block | Block |
agent-created | Allow | Allow | Ask |
Sources: tools/skills_guard.py51-61 tools/skills_guard.py98-179 tools/skills_guard.py193-199 tools/skills_guard.py280-289 tools/skills_guard.py330-340
Skills are distributed as directories containing a mandatory SKILL.md file. skills/software-development/simplify-code/SKILL.md
The hub manages its internal state in ~/.hermes/skills/.hub/:
The sync_skills function ensures that bundled skills are seeded into the user's profile while respecting local modifications. website/scripts/extract-skills.py
.bundled_manifest (v2 format name:hash) to track the origin state. website/scripts/extract-skills.pySources: tools/skills_hub.py77-99 skills/software-development/simplify-code/SKILL.md website/scripts/extract-skills.py
The hermes_cli/skills_hub.py module provides the implementation for both CLI subcommands and interactive slash commands. hermes_cli/skills_hub.py3-11
| Command | Function |
|---|---|
do_search | Searches registries via unified_search and displays a Rich table. hermes_cli/skills_hub.py49-82 |
do_install | Orchestrates fetch -> quarantine -> scan -> install flow. hermes_cli/skills_hub.py126-153 |
do_list | Lists installed skills, distinguishing between hub, builtin, and local. tests/hermes_cli/test_skills_hub.py124-131 |
do_tap | Adds a new GitHub repository to the search index. tools/skills_hub.py1010-1030 |
do_update | Checks for updates for all hub-installed skills by comparing hashes. tools/skills_hub.py1260-1280 |
do_check | Checks for updates for a specific skill or all installed skills. tests/hermes_cli/test_skills_hub.py73-78 |
do_uninstall | Removes an installed skill and its entry from lock.json. hermes_cli/skills_hub.py340 |
do_reset | Resets a skill to its original bundled version, overwriting local changes. hermes_cli/skills_hub.py380 |
Sources: hermes_cli/skills_hub.py3-11 hermes_cli/skills_hub.py49-82 hermes_cli/skills_hub.py126-153 tools/skills_hub.py1010-1030 tools/skills_hub.py1260-1280 tests/hermes_cli/test_skills_hub.py73-78 tests/hermes_cli/test_skills_hub.py124-131 hermes_cli/skills_hub.py340 hermes_cli/skills_hub.py380
Refresh this wiki
This wiki was recently refreshed. Please wait 2 days to refresh again.