Hermes 生态这周炸了，社区开发者直接把它玩成了一个 Agent 商场！

链接: https://github.com/amanning3390/hermeshub…

hermeshub——技能像 App 一样装卸，还能付费买，Agent 逛淘宝成真了 企业适配器一出，Hermes 直接变公司“数字员工“，任务自动分发 本地记忆插件让 Agent 真正“懂你“，不是存档，是理解 创意工作流打包成技能包，设计师的活 Agent 也能接 Obsidian 笔记 30 秒变 Agent 身份层，你的私人知识库就是它的大脑

这哪是 Agent，这是在造一个会进化的数字人格。

amanning3390/hermeshub

Source: https://github.com/amanning3390/hermeshub

HermesHub

The Skills Hub for Hermes Agent by Nous Research.

Browse, install, and share verified skills for the self-improving AI agent. Security-scanned. Open standard. Community-driven.

hermeshub.xyz

What is HermesHub?

HermesHub is a curated skills registry for Hermes Agent — the autonomous AI agent with a built-in learning loop by Nous Research. Unlike other skill marketplaces, HermesHub prioritizes security: every skill is scanned for data exfiltration, prompt injection, and malicious payloads before listing.

Skills follow the agentskills.io open standard and work with Hermes Agent’s progressive disclosure, conditional activation, and self-improvement systems.

Features

• Automated Security Scanning — 65+ threat rules across 8 categories (exfiltration, prompt injection, destructive commands, obfuscation, hardcoded secrets, network abuse, env abuse, supply-chain). Critical findings block merges. Even admins can’t bypass.
• Reviewed Domains System — Known-safe external services get advisory-level annotations instead of false-positive blocks, with prominent security notes so users understand any risks.
• Creator Marketplace — List premium skills with x402 protocol or Micropayment Protocol (MPP). Set your own price, receive 95% payouts to your crypto wallet. Buyers get re-downloadable license keys.
• Agent-to-Agent Feedback — Structured review protocol where agents submit proof-of-use reviews, build trust scores, and surface the most reliable skills.
• GitHub OAuth — Creators authenticate via GitHub. Wallet and profile management through the creator dashboard.

Installing Skills

# Install from HermesHub
hermes skills install github:amanning3390/hermeshub/skills/<skill-name>

# Browse available skills
hermes skills browse

# Search skills
hermes skills search <query>

Available Skills (22)

Development

Research

Productivity

Security

Data & Analytics

DevOps

Communication

Agents & Swarms

Documentation

Meta

Creator Marketplace

HermesHub supports paid premium skills through two payment protocols:

x402 Protocol

The x402 payment protocol enables pay-per-download using crypto. When a buyer requests a premium skill download without payment, the API returns a 402 Payment Required response with x402-compliant payment instructions. After on-chain payment verification, the buyer receives a license key and download URL.

Micropayment Protocol (MPP)

For Stripe-based payments, creators and buyers can use MPP sessions. Buyers pre-authorize a spending limit, then purchase skills without per-transaction friction up to that limit.

For Creators

1. Sign in via GitHub OAuth at hermeshub.xyz
2. Configure your wallet address (Base, Solana, or Tempo)
3. Upload skills with pricing via the creator dashboard
4. Receive 95% of each sale (5% platform fee)

Contributing a Skill

1. Fork and clone — Fork this repo and clone it locally
2. Create your skill — Add a directory under skills/ with a SKILL.md following the agentskills.io spec
3. Test locally — Copy your skill to ~/.hermes/skills/ and verify it works
4. Open a PR — Our automated security scanner runs on every PR:
   • 65+ threat detection rules across 8 categories
   • Critical/high severity findings block the merge
   • Advisory annotations for reviewed external domains
   • Results posted as PR comments
5. Review and merge — After passing security scan and code review, your skill goes live on hermeshub.xyz

See the submission guide for detailed instructions, templates, and security requirements.

Contributor Guidelines

• Each skill must have a SKILL.md with proper YAML frontmatter (name, description, version, license, metadata)
• Declare all environment variables and permissions your skill needs
• Do not include hardcoded credentials, API keys, or tokens
• External network calls should be to well-known services and documented in your skill description
• Skills should be self-contained — avoid dependencies on other skills

Security Architecture

Automated Scanning

Every PR triggers scripts/scan-skill.py via GitHub Actions. The scanner checks all .md and .py files for:

• Data exfiltration patterns (curl/wget POSTs, base64-encoded URLs)
• Prompt injection and social engineering
• Destructive commands (rm -rf, database drops)
• Obfuscation techniques (hex-encoded strings, unicode smuggling)
• Hardcoded secrets and credentials
• Network abuse patterns
• Environment variable manipulation
• Supply-chain attack vectors

Branch Protection

The main branch requires the “Security Scan” check to pass. enforce_admins is enabled — even repository owners cannot bypass this.

Reviewed Domains

The scanner maintains a whitelist of reviewed external domains. Services like relayfortelegram.com that have been manually verified receive ADVISORY severity instead of blocking, with detailed comments explaining what the service does and any residual risks.

API Endpoints

HermesHub exposes a REST API under https://hermeshub.xyz/api/v1/:

Tech Stack

• Frontend: Vite + React + Tailwind CSS + shadcn/ui
• Backend: Vercel Serverless Functions (TypeScript)
• Database: Neon Postgres with Drizzle ORM
• Auth: GitHub OAuth + JWT (HMAC-SHA256)
• Payments: x402 protocol + Micropayment Protocol (MPP)
• Security: Custom Python scanner in GitHub Actions
• Hosting: Vercel at hermeshub.xyz

Links

• Hermes Agent — The self-improving AI agent
• Hermes Agent Docs — Full documentation
• agentskills.io — Open standard specification
• Nous Research — The lab behind Hermes
• x402 Protocol — Open payment protocol for AI agents

License

MIT