The Community Ecosystem

The Ecosystem at a Glance

As of August 2026, the Hermes Skills Hub indexes 90,700 skills across 11 registries. That number is striking until you understand how it breaks down:

The community index froze July 20, 2026, so these figures reflect that snapshot. Claude Code skills are discoverable through GitHub project repositories and plugin directories rather than a centralized registry — the same open standard, a different discovery path.

Search Before You Write

Before authoring a new skill from scratch, run a search. A well-maintained community skill at a trusted tier requires zero authoring time and may be better than what you'd write in an afternoon. The Hermes discovery commands:

• hermes skills search <query> — full-text search across all registered skills, ranked by relevance
• hermes skills inspect <skill-path> — preview frontmatter and description before installing; shows compatibility, license, and version without downloading the full SKILL.md
• hermes skills tap add owner/repo — add a private GitHub repository as a skill source; useful for team or vendor skills not in the public Hub
• hermes skills install registry/skill-name — install a skill from any registered source
• hermes skills audit — rescan all installed skills on demand against the current detection rules

For Claude Code, community skills are discoverable by searching GitHub repositories tagged with relevant topics. Once found, add the repo as a tap with hermes skills tap add owner/repo so teammates can install from it, or copy the skill directory directly to .claude/skills/.

Trust Tiers

Not all skills carry equal confidence. The Hub assigns every skill one of four trust tiers based on its source:

Builtin and official skills are vetted by the Nous Research team. Trusted vendors operate under a code of conduct agreement with the registry. Community skills carry no vetting guarantee — the audit findings below explain what that means in practice.

The February 2026 Koi Security Audit

In February 2026, Koi Security conducted a comprehensive examination of the ClawHub / OpenClaw registry. Initial findings identified 341 outright malicious skills; as the investigation expanded and the registry continued to grow past 10,700 skills, the confirmed count reached 824 malicious skills.

Four categories of malice were found:

• Data exfiltration — skills that used embedded shell commands to send file contents, environment variables, or credentials to external endpoints during a normal-looking workflow
• Prompt injection payloads — skills that injected adversarial instructions into the agent's context to override the user's stated intent mid-session
• Destructive command sequences — skills that included file deletion, permission modification, or destructive disk operations in otherwise routine procedures
• Supply-chain signals — skills that fetched additional content from external URLs during installation or first run, enabling behavior updates after the initial scan

All 824 skills were removed after the audit. The incident does not mean ClawHub is uniquely dangerous — it means any community registry, on any platform, can harbor malicious skills regardless of the platform's reputation or stated security posture.

What Hub Scanning Actually Catches

Every Hermes Hub installation triggers automated security scanning before the skill is added to your library. The scanner checks for the four categories identified by the Koi audit: exfiltration patterns, prompt injection payloads, destructive commands, and supply-chain signals. Results are written to an append-only lock file alongside each installed skill, with a content hash of the SKILL.md at install time.

Some findings require a --force flag to install anyway; the worst cases are blocked entirely. A skill that passes automated scanning still warrants manual review: automated tools catch known patterns, not novel attacks. Adversarial authors specifically design around scanner heuristics.

Evaluation Checklist Before Installing

Before adding a community skill to your library, run through these seven checks:

1. Read the SKILL.md before running it. Check ! shell commands, hooks blocks, and any scripts/ files for suspicious behavior. A five-minute read is worth the cost of a breach.
2. Check the trust tier. Builtin, official, and trusted-tier skills are vetted. Community is not.
3. Verify the source repository. Is the author real? Recent commits? An active issues section? Abandoned repos are a supply-chain risk.
4. Check the compatibility field. Vague or missing compatibility is a yellow flag — a well-maintained skill declares what it requires.
5. Audit hooks blocks. A community skill that registers session-wide hooks needs extra scrutiny — hooks persist for the entire session after invocation.
6. Test in isolation first. Run the skill in a sandboxed session with no sensitive files or credentials accessible before adding it to your library.
7. Review the lock file (Hermes). Installation scan results are written to the lock file — read the verdict before trusting the skill in a real workflow.

The 90,000-Skill Problem

Quantity is not quality. Most of the 90,501 community skills were generated automatically from documentation or other skills, with minimal review or testing. ClawHub's 69,150 skills include duplicates, broken skills referencing deprecated APIs, and skills that never worked outside the author's machine.

The practical starting point: 82 built-in Hermes skills and Anthropic's bundled Claude Code skills. These are actively maintained, tested against current platform versions, and represent the sustained effort of the teams that build and ship the platforms. Expand to official and trusted tiers before considering community sources — and when you do reach community, apply the evaluation checklist on every install, not just the first one.