Hermes Agent skills: the ones it writes and the ones you install

What a skill is to Hermes

Nous’s skills page calls skills “on-demand knowledge documents the agent can load when needed” and the agent’s “procedural memory”. They sit beside its memory, which holds short facts that are always in its context; its guide’s rule of thumb is “If you’d put it in a reference document, it’s a skill. If you’d put it on a sticky note, it’s memory.” Only each skill’s name and description sit in the system prompt, and the full text loads when the model asks for it, which keeps a library of dozens cheap.

The format is the open Agent Skills specification that Claude Code, Codex and OpenCode also read, with Hermes’s own fields added. A bundled skill opens like this:

---
name: systematic-debugging
description: "4-phase root cause debugging: understand bugs before fixing."
version: 1.1.0
author: Hermes Agent (adapted from obra/superpowers)
license: MIT
platforms: [linux, macos, windows]
metadata:
  hermes:
    tags: [debugging, troubleshooting, problem-solving, root-cause, investigation]
    related_skills: [test-driven-development, subagent-driven-development]
---

Installed with Nous’s script on an Ubuntu 24.04 server on October 13, 2026, Hermes printed “Syncing bundled skills... + 58 new” and filed them in twelve category folders, from autonomous-ai-agents (skills for driving Claude Code, Codex and OpenCode) to research, productivity and software-development. On Linux, hermes skills list shows 53 of them, and the Apple skills in that folder, such as Notes and Find My, are not among them: a skill can name the platforms it runs on, and Hermes hides it elsewhere. Another 155 optional skills ship in Hermes’s repository and install with hermes skills install official/<category>/<skill>.

Where skills live

A project’s skills win over yours, and yours over shared folders. Hermes does not read .claude/skills/, so a skill shared with Claude Code goes in .agents/skills/ or a folder you add to external_dirs; the guide to Agent Skills shows one folder every agent reads. Nous adds a warning about that list: “External dirs are not a write-protection boundary”, since Hermes edits skills where it finds them.

The skills Hermes writes itself

The system prompt tells the model: “When you work out a non-trivial workflow, record it with skill_manage for future reuse.” Nous lists when that happens: when it “worked out a multi-step workflow worth repeating”, “hit errors or dead ends and found the working path”, or when “the user corrected its approach”. A skill is meant to hold “lessons, not logs”. skill_manage can create, patch, rewrite and delete skills and add files beside them.

A second process does the same after you have worked with it. Every so many tool-calling steps, a background review reads the conversation and updates the library, and the prompt Nous gives it is direct: “Be ACTIVE — most sessions produce at least one skill update, even if small.” It prefers to extend a skill that was in use, and Nous’s curator page says it “can patch, rewrite, and add support files to any skill it learns from (hand-written, URL-installed, bundled, hub-installed, external, or pinned)”. One consequence: a bundled or installed skill the review has edited counts as yours from then on, so hermes update and hermes skills update stop replacing it. The fresh install’s config.yaml sets the interval in its skills section, with its own comment:

skills:
  # Nudge the agent to create skills after complex tasks.
  # Every N tool-calling iterations, remind the model to consider saving a skill.
  # Set to 0 to disable.
  creation_nudge_interval: 15

Three controls matter if you want to see what it learns before it keeps it:

• Approve every write. “By default the agent writes skills freely”. With skills.write_approval: true, every skill_manage write is staged instead, and /skills pending, /skills diff <id>, /skills approve <id> and /skills reject <id> review them, in the terminal or on a messaging app.
• Turn the review off. auxiliary.background_review.enabled: false stops the automatic review after turns; /refine still runs it when you ask. It can also be sent to a cheaper model with auxiliary.background_review.provider and model.
• Teach it on purpose. /learn turns a folder, a URL, notes, a book or “The workflow you just walked the agent through in this conversation” into a skill, and /refine save the deploy workflow as a skill runs the review now with a focus.

The curator: what happens to skills nobody uses

The curator stops self-written skills from piling up. It is narrower than it sounds: it manages only skills the background review created. Skills the agent saves in a conversation, including with /learn, “are considered user-directed and the curator intentionally leaves them alone”, and so are skills you wrote, bundled skills and installed ones. Hermes’s installer announced it on the fresh install: “First pass is deferred ~7d after installation; only agent-created skills are in scope and nothing is ever auto-deleted (archive is recoverable).” And hermes curator status printed its defaults:

curator: ENABLED
  runs:           0
  last run:       never
  interval:       every 7d
  stale after:    14d unused
  archive after:  30d unused
  consolidate:    off (prune-only; LLM merge pass opt-in)

An archived skill moves to ~/.hermes/skills/.archive/ and out of the prompt; hermes curator restore <name> brings it back. hermes curator pin protects one from archiving and from the agent deleting it, pause stops the curator, and ledger lists every change any of them made, which rollback can undo. Deletion happens only when you run hermes curator purge, which removes archived skills older than curator.archive_ttl_days. The curator page describes the ages two ways; the defaults above and Hermes’s code agree on 14 and 30 days.

Using a skill

Mostly the model picks one itself from the index in its prompt. You can also name it: every installed skill is a slash command (/github, /systematic-debugging fix the failing test), up to five at the start of a message, with the rest of the message as the instruction. hermes -s <name> preloads one for a session, skills.auto_load loads some in every session, and a scheduled job takes them with hermes cron create … --skill. A skill whose name matches a built-in command, such as /plan, keeps the command and is reached as /skill <name>.

Installing other people’s skills

hermes skills search looks across Nous’s optional skills, GitHub repositories, skills.sh, sites that publish skills at /.well-known/skills/, ClawHub and two smaller catalogues, and Nous’s own Skills Hub page lists about 100,000 of them, four-fifths from ClawHub. The commands:

hermes skills search kubernetes                 # every source
hermes skills inspect openai/skills/k8s         # a preview: the first 50 lines, no scan
hermes skills install openai/skills/k8s         # quarantine, scan, then install
hermes skills audit                             # scan installed hub skills again
hermes skills uninstall k8s                     # remove a hub-installed skill

Each result carries a trust level, and the level decides what the scan’s findings do. In Hermes’s install policy (tools/skills_guard.py, v0.21.7), a finding rated high makes a skill “caution” and one rated critical makes it “dangerous”; medium and low findings are shown and allowed:

Binary files and links pointing outside the skill count as critical. Installing a community skill from skills.sh on a fresh install shows the whole path:

Quarantined to .hub/quarantine/changelog-automation
Running security scan...
Scan: changelog-automation (skills-sh/wshobson/agents/changelog-automation/community)  Verdict: SAFE
  MEDIUM   supply_chain   references/details.md:398      "pip install commitizen"
  MEDIUM   supply_chain   references/details.md:80       "npm install -D @commitlint/cli @commitlint/config-convention"
  ...
Decision: ALLOWED — Allowed (community source, safe verdict)
Scan provenance: fresh; scanner skills-guard-v10; hash sha256:65a543ae…
Installed: changelog-automation

The skill landed in ~/.hermes/skills/changelog-automation/, and ~/.hermes/skills/.hub/lock.json recorded its source pinned to the repository’s commit, its content hash, the scanner version and every finding, which is what hermes skills update compares against later. hermes skills uninstall removes skills installed this way; a skill you or Hermes wrote is removed by deleting its folder or archiving it with hermes curator archive.

Before you install someone else’s

The scan matches patterns, and Nous is plain about its limits. Its security policy says Skills Guard “is a review aid; the boundary for third-party skills is operator review before install. Reviewing a skill means reading its Python code and scripts, not just its SKILL.md description”, and that a skill doing something malicious “is the expected failure mode of one that wasn’t reviewed, not a vulnerability in Hermes Agent.” The confirmation Hermes shows before a third-party install says the same: “Even after automated scanning, you should review the installed files before use.” That prompt is skipped with --yes, with --force and when you install from inside a chat with /skills install, though the scan still runs.

The risk is not theoretical. In February 2026 an audit of 2,857 skills on ClawHub, OpenClaw’s skill registry, found 341 malicious ones, 335 of which, in The Hacker News’s report, “use fake pre-requisites to install an Apple macOS stealer”. Hermes gives every ClawHub skill community trust. Before installing one:

• Run hermes skills inspect, then read the whole skill after install, scripts and reference files included, before the agent uses it.
• Treat any step that has the agent download and run something as a prerequisite as the warning sign it was in that campaign.
• Check what it declares: a skill can ask for environment variables and credential files, and a blueprint: block suggests a scheduled job, which Hermes registers as a suggestion and never starts on install.
• Remember the agent runs with your account’s reach, so what a skill can make it do is whatever you could do on that machine. On a computer of its own, that reach is only what you have put there.

A cloned repository’s skills are held back until you run hermes skills trust there, and Hermes scans them before they load; scheduled jobs follow the decision you made in the terminal. To switch a skill off without removing it, hermes skills config enables and disables skills for every platform or one at a time, and hermes skills reset <name> --restore brings back the stock copy of a bundled skill you or the agent changed.