The Hermes Skills Hub is a discovery and distribution layer for reusable agent procedures. It can save hours when a maintained skill already matches your job, but the correct workflow is search, inspect, test, then keep — not bulk install.
Quick answer#
Browse with hermes skills browse, search with hermes skills search <query>, preview a candidate with hermes skills inspect <id>, and install only after reviewing its commands, references, permissions, and trigger description. External installs run a security scan, but you should still use hermes skills audit and a restricted test. Keep the Hermes skills evaluation guide open while choosing a skill.
hermes skills browse
hermes skills search kubernetes
hermes skills inspect openai/skills/k8s
hermes skills install openai/skills/k8s
hermes skills audit
Search the right source#
Hermes can discover skills from official sources, community directories such as skills.sh, well-known skill indexes, direct GitHub paths, and direct SKILL.md URLs. Source availability and identifiers can change, so use hermes skills browse and search in the installed version rather than copying an old catalog URL.
A source tells you where the package came from. It does not tell you whether the procedure is safe or useful for your environment.
Inspect before install#
hermes skills inspect is the most important command in the workflow. Review:
- the frontmatter description and trigger;
- shell commands and helper scripts;
- URLs and downloaded files;
- requested environment variables or secrets;
- tools and permissions the procedure assumes;
- version-specific commands;
- expected artifacts and verification steps.
If the skill overlaps a native tool, another skill, memory, or an MCP server, prefer the simpler owner. The skill vs memory vs MCP decision explains the boundary.
Install and test safely#
Install one candidate at a time. For skills that write files, run shell commands, access authenticated browser sessions, or call paid services, test in a disposable directory or isolated Hermes profile.
Define an input fixture, allowed tools, forbidden actions, expected artifact, and acceptance checks before the run. A security scan catches known suspicious patterns; it does not prove that a procedure is correct, current, or appropriate.
Maintain the installed set#
Use the lifecycle commands instead of letting skills accumulate:
hermes skills list
hermes skills check
hermes skills update
hermes skills audit
hermes skills uninstall <name>
Re-run the acceptance test after updates. Remove stale, overlapping, noisy, or unused skills. If context grows, inspect it with /context and use the Hermes token overhead guide.
Create instead of install#
Build your own skill when the workflow is unique, proven manually, and stable enough to reuse. The custom skill tutorial covers the SKILL.md structure, supporting files, trigger quality, and tests. Do not fork a large community skill merely to store a one-line preference; that belongs in memory or project instructions.
Security checklist#
- Inspect every external skill before installation.
- Never paste secrets into
SKILL.md. - Treat helper scripts as code, not documentation.
- Keep approvals for destructive or public side effects.
- Use scoped profiles for different trust levels.
- Audit after installation and after updates.
- Use the Hermes security guide and MCP security guide for high-risk extensions.
Current demand#
Fresh August 2026 creator coverage focuses on skill quality, provenance, injection risk, overlap, and bloat rather than raw catalog size. That makes evaluation the practical job. Use the Hub to discover candidates, then keep only skills that pass a real test and reduce repeated work.
A five-minute candidate comparison#
When several results look similar, inspect them side by side before installing any of them. Prefer the candidate with the narrowest useful trigger, current commands, explicit prerequisites, clear non-goals, and a real acceptance check. Reject a candidate that asks for broad credentials without explaining why, downloads opaque executables, disables approvals, or promises a result without a verification step.
Record the candidate ID, source, last-change date, tools requested, and expected output. Then choose one. Installing three overlapping skills to “see which one wins” makes the test harder because you cannot tell which procedure shaped the result.
After the first successful run#
Save the input fixture and acceptance result beside your team documentation. If the skill supports a production process, pin the reviewed source or version where practical and schedule a periodic hermes skills check plus manual review. An upstream update is a change request, not automatic proof that the new procedure is better.
If the skill becomes central to the business, consider forking it into a team-owned source with named maintainers, change review, and regression fixtures. If the job stays project-specific, keep the skill scoped to the appropriate profile rather than enabling it everywhere.