Hermes Agent Skills

A curated collection of skills for Hermes Agent, covering software development, security review, research, productivity, creative tooling, MCP usage, and agent operations.

This repository currently contains 1422 published SKILL.md files plus generated routing artifacts. It is a curated export of live local Hermes runtime skills, not a blind copy of a local ~/.hermes/skills tree: archives, virtualenvs, vendored .git trees, obvious credential artifacts, binary dependency outputs, wallet/reward/funds-adjacent automation, and secret-like examples are excluded or sanitized during publication.

Install Safely

Clone and validate first:

git clone https://github.com/Undermybelt/hermes-skills.git
cd hermes-skills
python3 scripts/validate_skills.py

Install one reviewed skill:

mkdir -p ~/.hermes/skills/software-development
rsync -a skills/software-development/hermes-agent-sec-review/ \
  ~/.hermes/skills/software-development/hermes-agent-sec-review/

Bulk installs should be deliberate. Review the validation warnings and run a dry-run before copying into the runtime skill directory:

rsync -an skills/ ~/.hermes/skills/

Remove -n only after confirming the destination changes are intended.

Categories

Category	Skills	Notes
red-teaming/	757	Security research, defensive review, forensics, malware, cloud, governance
community/	494	Imported public/community skill packs under stable namespaces
software-development/	65	Coding workflows, testing, routing, release, repo intake
aegis/	22	Architecture, planning, verification, reviews, long-task governance
research/	18	Paper discovery, synthesis, market/research tools
devops/	17	Browser, MCP, deployment, local service, and operations workflows
autonomous-ai-agents/	5	Hermes, Codex, Claude Code, OpenCode and related agents
creative/	8	Art, diagrams, animation, design references
productivity/	6	Documents, maps, Notion, Google Workspace, PowerPoint
apple/	5	macOS, browser/CDP, Reminders, sandbox app data
github/	5	Auth, PRs, issues, reviews, repo management
mlops/	5	Training, inference, evaluation, models, vector databases
Other categories	15	Smaller focused groups across 9 categories

Safety Model

• Treat external skills and scripts as untrusted until reviewed.
• Do not execute installer scripts, package installs, browser automation, MCP servers, credential setup, trading/funds workflows, or destructive commands just because a skill mentions them.
• The validator checks common metadata errors and obvious secret literals. It does not prove that a skill is safe or up to date.
• Some skills contain commands that write to ~/.hermes, ~/.config, browser state, MCP config, or service credential stores. Read those files before use.
• See SECURITY.md for the repository security policy and publishing checklist.

Maintenance

Run validation before every commit:

python3 scripts/validate_skills.py

The validation script checks:

• every SKILL.md has YAML-style frontmatter with name and description
• duplicate frontmatter skill names as warnings; route keys remain authoritative
• generated routing index parity with the published skills/ tree
• embedded .git repositories under skills/
• common literal secret patterns
• warning-level risk patterns such as package installs, pipe-to-shell commands, persistence hooks, credential setup, and dynamic execution

Refresh the repository from the local Hermes runtime:

python3 scripts/sync_publishable_from_runtime.py --apply
python3 scripts/validate_skills.py

Use strict mode when curating a low-risk subset:

python3 scripts/validate_skills.py --strict

Skill Format

Each skill follows a standard format:

---
name: skill-name
description: What this skill does
tags: [tag1, tag2]
---

## Triggers
When to load this skill

## Steps
1. Do this
2. Do that

## Pitfalls
- Watch out for X
- Avoid Y

## Verification
How to verify it worked

Contributing

1. Fork this repository
2. Create or update a skill following the format above
3. Run python3 scripts/validate_skills.py
4. Submit a pull request

License

See license and attribution notes in individual skill folders when present. Do not assume third-party references, generated examples, or copied upstream material share the same license unless the folder says so explicitly.

Acknowledgments

• Hermes Agent — The AI agent framework
• Anthropic Cybersecurity Skills — Security research skills
• Community contributions and feedback