Feature
Hermes Skill Marketplace: Discover Skills Without Installing Blindly
Quick answer
Browse with `hermes skills browse`, search with `hermes skills search`, and preview with `hermes skills inspect` before installing. External installs run a security scan, but you should still review permissions, test the expected artifact, audit updates, and remove stale or overlapping skills.
Key Points
- ✓Search official and community skill sources
- ✓Inspect SKILL.md before installation
- ✓Run a security scan during external installs
- ✓Audit installed skills and upstream updates
- ✓Remove stale or overlapping procedures
How It Works
- 1Search or browse the source catalog
- 2Inspect triggers, commands, scripts, and permissions
- 3Install one candidate after review
- 4Test it with a bounded task and expected artifact
- 5Audit, update, or uninstall it deliberately
Real-World Use Cases
Install a proven workflow
Reuse a maintained deployment, research, or reporting procedure after inspecting its source and testing it against your environment.
Standardize a team runbook
Package a tested release, incident, or QA procedure so every operator follows the same steps and acceptance checks.
Evaluate extensions safely
Compare a skill with native tools, memory, MCP, and existing skills before adding another persistent instruction layer.
Maintain a small trusted set
Audit versions, remove overlaps, and keep only skills that continue to improve repeat work.
Under the Hood
Hermes can discover skills from supported official and community sources, well-known indexes, GitHub paths, and direct SKILL.md URLs. Use the installed CLI to see current source names and identifiers. `hermes skills inspect` lets you review a candidate before installation; `hermes skills install` runs an external-skill security scan; `hermes skills audit`, `check`, `update`, and `uninstall` cover the lifecycle. A scan detects known suspicious patterns but cannot prove that commands are current, safe for your environment, or useful. Test every high-impact skill in a restricted profile or disposable project and verify a real artifact before keeping it.
Frequently asked questions
How do I install a skill from the Hermes marketplace?
Discover it with `hermes skills browse` or `search`, preview it with `hermes skills inspect <id>`, then install with `hermes skills install <id>` after reviewing source and permissions.
Are community Hermes skills safe?
External installs run a security scan, but you must still inspect source, scripts, URLs, secrets, and tool assumptions. Test high-impact skills with restricted permissions.
How do I audit installed Hermes skills?
Run `hermes skills audit`, `check`, and `list`. Update deliberately, rerun the acceptance test, and uninstall skills that are stale, overlapping, or unused.