Files

teknium1 f6f3d1de9b fix: review fixes — path traversal guard, trust_style consistency, edge cases

Address code review findings:

Security (Medium):
- Path traversal guard in OptionalSkillSource.fetch() — resolve() and
  validate that the path stays within optional-skills/ before reading

Bug fixes (Medium):
- Add 'builtin' to trust_style dicts in do_inspect() and
  _resolve_short_name() — official skills now show bright_cyan 'official'
  label consistently across all display functions (5/5 dicts fixed)

Edge cases (Low):
- Clamp page_size to [1, 100] in do_browse() to prevent ZeroDivisionError
- Update SkillMeta.source docstring to include 'official'
- Add browse command to optional-skills/DESCRIPTION.md

2026-03-06 01:40:01 -08:00

1015 B

Raw Blame History

Optional Skills

Official skills maintained by Nous Research that are not activated by default.

These skills ship with the hermes-agent repository but are not copied to ~/.hermes/skills/ during setup. They are discoverable via the Skills Hub:

hermes skills browse               # browse all skills, official shown first
hermes skills browse --source official  # browse only official optional skills
hermes skills search <query>       # finds optional skills labeled "official"
hermes skills install <identifier> # copies to ~/.hermes/skills/ and activates

Why optional?

Some skills are useful but not broadly needed by every user:

Niche integrations — specific paid services, specialized tools
Experimental features — promising but not yet proven
Heavyweight dependencies — require significant setup (API keys, installs)

By keeping them optional, we keep the default skill set lean while still providing curated, tested, official skills for users who want them.

1015 B Raw Blame History

Optional Skills

Why optional?

1015 B

Raw Blame History