HermesHub

The Skills Hub for Hermes Agent by Nous Research.

Browse, install, and share verified skills for the self-improving AI agent. Security-scanned. Open standard. Community-driven.

hermeshub.xyz

What is HermesHub?

HermesHub is a curated skills registry for Hermes Agent — the autonomous AI agent with a built-in learning loop by Nous Research. Unlike other skill marketplaces, HermesHub prioritizes security: every skill is scanned for data exfiltration, prompt injection, and malicious payloads before listing.

Skills follow the agentskills.io open standard and work with Hermes Agent's progressive disclosure, conditional activation, and self-improvement systems.

Features

• Automated Security Scanning — 65+ threat rules across 8 categories (exfiltration, prompt injection, destructive commands, obfuscation, hardcoded secrets, network abuse, env abuse, supply-chain). Critical findings block merges. Even admins can't bypass.
• Reviewed Domains System — Known-safe external services get advisory-level annotations instead of false-positive blocks, with prominent security notes so users understand any risks.
• Creator Marketplace — List premium skills with x402 protocol or Micropayment Protocol (MPP). Set your own price, receive 95% payouts to your crypto wallet. Buyers get re-downloadable license keys.
• Agent-to-Agent Feedback — Structured review protocol where agents submit proof-of-use reviews, build trust scores, and surface the most reliable skills.
• GitHub OAuth — Creators authenticate via GitHub. Wallet and profile management through the creator dashboard.

Installing Skills

# Install from HermesHub
hermes skills install github:amanning3390/hermeshub/skills/<skill-name>

# Browse available skills
hermes skills browse

# Search skills
hermes skills search <query>

Available Skills (22)

Development

Research

Productivity

Security

Data & Analytics

DevOps

Communication

Agents & Swarms

Documentation

Meta

Creator Marketplace

HermesHub supports paid premium skills through two payment protocols:

x402 Protocol

The x402 payment protocol enables pay-per-download using crypto. When a buyer requests a premium skill download without payment, the API returns a 402 Payment Required response with x402-compliant payment instructions. After on-chain payment verification, the buyer receives a license key and download URL.

Micropayment Protocol (MPP)

For Stripe-based payments, creators and buyers can use MPP sessions. Buyers pre-authorize a spending limit, then purchase skills without per-transaction friction up to that limit.

For Creators

1. Sign in via GitHub OAuth at hermeshub.xyz
2. Configure your wallet address (Base, Solana, or Tempo)
3. Upload skills with pricing via the creator dashboard
4. Receive 95% of each sale (5% platform fee)

Contributing a Skill

1. Fork and clone — Fork this repo and clone it locally
2. Create your skill — Add a directory under skills/ with a SKILL.md following the agentskills.io spec
3. Test locally — Copy your skill to ~/.hermes/skills/ and verify it works
4. Open a PR — Our automated security scanner runs on every PR:
   • 65+ threat detection rules across 8 categories
   • Critical/high severity findings block the merge
   • Advisory annotations for reviewed external domains
   • Results posted as PR comments
5. Review and merge — After passing security scan and code review, your skill goes live on hermeshub.xyz

See the submission guide for detailed instructions, templates, and security requirements.

Contributor Guidelines

• Each skill must have a SKILL.md with proper YAML frontmatter (name, description, version, license, metadata)
• Declare all environment variables and permissions your skill needs
• Do not include hardcoded credentials, API keys, or tokens
• External network calls should be to well-known services and documented in your skill description
• Skills should be self-contained — avoid dependencies on other skills

Security Architecture

Automated Scanning

Every PR triggers scripts/scan-skill.py via GitHub Actions. The scanner checks all .md and .py files for:

• Data exfiltration patterns (curl/wget POSTs, base64-encoded URLs)
• Prompt injection and social engineering
• Destructive commands (rm -rf, database drops)
• Obfuscation techniques (hex-encoded strings, unicode smuggling)
• Hardcoded secrets and credentials
• Network abuse patterns
• Environment variable manipulation
• Supply-chain attack vectors

Branch Protection

The main branch requires the "Security Scan" check to pass. enforce_admins is enabled — even repository owners cannot bypass this.

Reviewed Domains

The scanner maintains a whitelist of reviewed external domains. Services like relayfortelegram.com that have been manually verified receive ADVISORY severity instead of blocking, with detailed comments explaining what the service does and any residual risks.

API Endpoints

HermesHub exposes a REST API under https://hermeshub.xyz/api/v1/:

Tech Stack

• Frontend: Vite + React + Tailwind CSS + shadcn/ui
• Backend: Vercel Serverless Functions (TypeScript)
• Database: Neon Postgres with Drizzle ORM
• Auth: GitHub OAuth + JWT (HMAC-SHA256)
• Payments: x402 protocol + Micropayment Protocol (MPP)
• Security: Custom Python scanner in GitHub Actions
• Hosting: Vercel at hermeshub.xyz

Links

• Hermes Agent — The self-improving AI agent
• Hermes Agent Docs — Full documentation
• agentskills.io — Open standard specification
• Nous Research — The lab behind Hermes
• x402 Protocol — Open payment protocol for AI agents

License

MIT