Community Catalog

The Community Catalog can be understood as a community skill repository. If Reusable Procedures was about you packaging your own procedures, then Community Catalog is about not having to rewrite what others already did well. Hermes ships with an ecosystem of skill sources you can browse, install, and use right away — collectively called the Skills Hub.

Practical sources

Not one single centralized catalog, but several distinct sources, each fitting a different situation:

hermes skills search kubernetes                   # search across all sources
hermes skills search react --source skills-sh      # Vercel's public catalog
hermes skills search https://mintlify.com/docs --source well-known  # skills published by the site itself
hermes skills install openai/skills/k8s             # install directly from a GitHub tap

Example: your team uses Mintlify to write product docs — instead of teaching the agent how to operate Mintlify from scratch, you query the well-known endpoint that Mintlify itself publishes (/.well-known/skills/index.json) and install the skill they already wrote for exactly that.

Before installing — always preview

hermes skills inspect openai/skills/k8s

This shows you the skill’s content, the original repo, weekly install counts, and the upstream security audit status — before you decide to bring it into a system that is actually running.

Security is not optional, it is the default

Every skill installed from the hub passes through a scanner checking for data leaks, prompt injection, destructive commands, and more. Trust levels are clearly tiered:

This is a point worth emphasizing: --force cannot override a “dangerous” level warning — it only overrides the ordinary cautionary warnings that you have reviewed yourself.

Tracking upstream updates

A community skill is not install-once-and-forget — the original author may fix, patch, or extend it:

hermes skills check          # which skills have new updates
hermes skills update         # update those skills

If you have already edited a hub-installed skill yourself, Hermes detects it via a content hash and automatically skips it without overwriting — unless you explicitly add --force.

When you need to share internally with the team

You don’t have to go public. You can create your own “tap” — a private GitHub repo containing SKILL.md files — and have colleagues subscribe:

hermes skills tap add my-org/hermes-skills
hermes skills install my-org/hermes-skills/deploy-runbook

Notes

• Always inspect before install, especially for community source skills — don’t just trust a name that sounds familiar.
• --force being blocked at “dangerous” warnings is a deliberate safety boundary — if a skill is blocked at that level, find a different skill instead of trying to squeeze past it.
• For company-specific workflows (internal CRM connections, house PR standards), publishing your own tap is usually more worthwhile than hunting for a similar public skill and editing it afterwards.