Skills Guide

Hermes Skills Hub: One Search Across Every Skill Registry

Q: Can the Hermes agent install skills by itself?

Not from the hub — installing third-party skills is a user action. The agent can, however, create, update and delete its own skills through the skill_manage tool, which Hermes describes as its procedural memory.

Q: Which registries does the Skills Hub search?

Seven searchable sources: official, skills-sh, well-known, github, clawhub, lobehub and browse-sh, narrowed with --source. A direct URL is install-only and cannot be searched.

Q: What does the security scanner block?

It scans for data exfiltration, prompt injection, destructive commands and supply-chain signals. --force overrides non-dangerous findings, but a dangerous verdict remains blocked.

Q: Where do installed skills live on disk?

Installed skills live in ~/.hermes/skills/. Hub state is in ~/.hermes/skills/.hub/ (lock.json, quarantine/, audit.log). Project skills in .hermes/skills/ or .agents/skills/ load only after running hermes skills trust for that repository.

Q: How do I follow a specific GitHub repo of skills?

Run hermes skills tap add to subscribe the hub to a custom repository.

Skills are the on-demand knowledge documents a Hermes agent loads when it needs them. The Skills Hub is the built-in system for finding, installing, auditing and updating them — with a security scanner in front, and a rule that installing someone else's skill is your decision, not the agent's.

What a skill is, in one paragraph

A skill is a SKILL.md file: a short document the agent loads only when the task calls for it. That progressive-disclosure pattern is the point — a hundred installed skills cost almost nothing in tokens until one is actually needed. The format follows the agentskills.io open standard, which is why the same file often works across more than one agent runtime.

The registries

The hub is a unified search over sources that would otherwise each need their own workflow:

Source	What it is
`official`	Hermes-maintained optional skills, addressed as `official/security/1password`
`skills-sh`	Vercel's public skills directory
`well-known`	Standards-based discovery from a site's `/.well-known/skills/index.json`
`github`	Direct repository installs, including `anthropics/skills` and `openai/skills`
`clawhub`	Third-party marketplace integration
`lobehub`	Converted entries from LobeHub's agent catalog
`browse-sh`	Browserbase site-specific browser-automation skills
`url`	A direct HTTP(S) link to a `SKILL.md` — install-only, not searchable

The command set

hermes skills browse                      # everything the hub knows about
hermes skills search <query> --source <s> # narrow to one registry
hermes skills inspect <identifier>        # read it BEFORE installing
hermes skills install <identifier>        # install, with a security scan
hermes skills check                       # what changed upstream
hermes skills update                      # reinstall those with updates
hermes skills uninstall <name>
hermes skills reset <name>                # drop local modification tracking
hermes skills tap add <owner/repo>        # follow a custom repo
hermes skills audit                       # re-scan everything installed

The two most under-used commands are inspect and audit. Inspect shows you the skill body before it can influence a single turn; audit re-scans skills you installed months ago, which matters because a repository you trusted then can change hands now.

Trust levels are not decoration

The hub ranks sources builtin → official → trusted → community, and the level determines how much scanner noise you are allowed to wave through. Skills Guard checks every external skill for data exfiltration, prompt injection, destructive commands and supply-chain signals.

The one rule worth memorising: --force overrides a warning, never a dangerous verdict. If you find yourself wanting to bypass a dangerous verdict, read the skill by hand instead — that verdict is the system working.

Where things land

~/.hermes/skills/                    # source of truth
~/.hermes/skills/.bundled_manifest   # installed versions
~/.hermes/skills/.hub/lock.json      # hub lockfile
~/.hermes/skills/.hub/quarantine/    # blocked installs
~/.hermes/skills/.hub/audit.log      # scan history
~/.hermes/skill-bundles/<slug>.yaml  # bundles
<project>/.hermes/skills/            # project-scoped, needs trust
<project>/.agents/skills/            # project-scoped, shared standard, needs trust

Project skills do not load until you trust the repo

This one surprises people, and it is the right behaviour. A skill is a procedure the agent follows, so Hermes deliberately does not auto-load skills out of an arbitrary cloned repository. The first time you run Hermes in a project that has them, the banner tells you they were found and not loaded.

hermes skills trust
hermes skills trust ~/myproject

Until you run that, .hermes/skills/ and .agents/skills/ in the project root are inert. Worth remembering when a skill you can see on disk appears to be ignored — the usual instinct is to go looking for a syntax error in the file.

Configuration worth setting on day one

skills:
  external_dirs:
    - ~/.agents/skills
    - /home/shared/team-skills

skills.external_dirs lets a team share one reviewed directory instead of every agent installing its own copy. Two other keys matter: skills.write_approval stages every skill write into ~/.hermes/pending/skills/ instead of committing it, and skills.project_discovery: false stops Hermes picking up skills from whatever repository it happens to be working in — worth turning off if your agent reads untrusted checkouts.

Hub skills versus written-in-place skills

The hub covers skills you install. It is not the mechanism by which an agent writes its own skill after working out a repeatable workflow — that runs through skill_manage, which Hermes treats as procedural memory and which is covered in our memory guide. Keeping the two apart is what makes the security model legible: the agent authors its own procedures freely, while pulling in third-party code stays a decision you make. If you would rather it not author freely either, skills.write_approval stages every one of those writes for review.

If you would rather not manage any of this by hand, OpenClaw Launch runs the Hermes Agent service for you and offers a curated skills marketplace on the dashboard.

Hermes Skills Hub FAQ

Can the Hermes agent install skills by itself?

Not from the hub — installing third-party code is a user action. But the agent is not walled off from skills generally: it can create, update and delete its own skills through the skill_manage tool, which Hermes describes as its procedural memory. The line is between authoring its own procedures and pulling in someone else's code.

Which registries does the Skills Hub search?

Seven searchable ones — official, skills-sh, well-known, github, clawhub, lobehub and browse-sh — which you can narrow with --source. A direct url is an eighth source but is install-only: there is nothing to search, so --source url is not a thing.

What does the security scanner block?

Skills Guard scans for data exfiltration, prompt injection, destructive commands and supply-chain signals. You can override a non-dangerous finding with --force, but a dangerous verdict stays blocked regardless of the flag.

Where do installed skills live on disk?

~/.hermes/skills/ is the source of truth. Hub bookkeeping sits in ~/.hermes/skills/.hub/ as lock.json, a quarantine/ directory and audit.log. Project-scoped skills come from .hermes/skills/ or .agents/skills/ in the project root — but only after you run hermes skills trust for that repo, since Hermes will not auto-load procedures out of an arbitrary checkout.

How do I follow a specific GitHub repo of skills?

Use hermes skills tap add <owner/repo>. That subscribes the hub to a custom repository so its skills appear in search alongside the built-in registries.