Hermes Skills Hub: Inspect, Install, Activate, and Verify a Skill

A Hermes Skill is an on-demand procedure, not something that must stay permanently loaded in every conversation. The difficult part is rarely finding a promising name. It is knowing what the Skill will do before installation, understanding the security result, making the new Skill visible to the right session, and proving that it can complete a task with an observable result.

This guide uses the official optional ascii-art Skill as a low-risk acceptance test. Its result is visible, can be saved as plain text, and can be checked with a short script. The commands and behavior below were checked against official Hermes documentation and repository pages opened on October 10, 2026. Search results and terminal wording can change, so use the exact identifier and scan result returned by your own Hermes version.

The workflow at a glance

Stage	Action	Pass condition
Find	Search the Hub and copy the full identifier	You know the source and exact target instead of guessing from a short name
Inspect	Use inspect for metadata and its truncated SKILL.md preview, then open the complete files from the exact source and version	The full bundle answers all six checks; otherwise you stop
Install	Use the interactive CLI when a human must decide before copying; a chat install treats the command itself as consent	You understand the post-scan confirmation boundary of each route
Activate	Start a new session, or use chat --now only after reviewing the exact bundle	The session recognizes the Skill’s slash command
Verify	Confirm the effective source and path, audit only a Hub-registered install, then invoke explicitly	The bytes actually loaded by the command—not merely a shadowed Hub copy—have been reviewed
Accept	Save the result and test its constraints	The output file exists and meets the agreed dimensions
Troubleshoot	Isolate identifier, cache, precedence, or dependency problems	The same minimal task passes after one controlled change

1. Prepare a narrow, reviewable test

You need a working Hermes installation and a terminal where hermes skills ... commands run. For a first installation, prefer an official optional Skill and a task that does not need an account, secret, or permission to modify an external system.

First see what is already available:

hermes skills list

If ascii-art already appears, do not assume it is the Hub copy and do not overwrite it merely to match this tutorial. Confirm the source shown by the list and check the nearest project root for same-named .hermes/skills/ or .agents/skills/ content; a project copy has higher precedence than the profile-local copy. The later audit validates the active /ascii-art bytes only when the Skill is Hub-registered and not shadowed. Otherwise review the full files of the effective copy, or choose another official optional Skill that is not already present for the complete install-and-audit exercise.

2. Search the Hub, then inspect before installing

Search by capability:

hermes skills search "ascii art"

The result should include a name, source, and full identifier. The official repository currently places this optional Skill at official/creative/ascii-art, but the identifier printed by your search is the value to trust for this run. Inspect it before making any change:

hermes skills inspect official/creative/ascii-art

Treat inspect as read-only, but not as a complete file review. The official implementation renders only the first 50 lines of SKILL.md and reports how many lines remain; metadata is shown separately, while bundled support files are not fully reviewed for you. Before installing, open the complete SKILL.md and every bundled or referenced support file from the same source, identifier, and version returned by search. For this example you can read the pinned full ASCII Art Skill, but confirm that it matches the bundle you will install. That pinned file has 322 lines, with network calls, sudo installation examples, and the custom fallback after the 50-line preview.

After reading the complete files, check at least these points:

1. Source and identifier: Is this the publisher and object you intended to trust?
2. Platform: Does the Skill declare support for your operating system?
3. Dependencies: Will it need a system package, Python package, or separate tool?
4. Network and services: Can any path send input to a third-party URL?
5. Files and commands: What can it read, create, modify, or execute?
6. Configuration and credentials: Does it require a login, API key, or elevated permission?

If the complete files do not answer any one of these checks, stop rather than treating the truncated preview as approval. The official ascii-art instructions contain local-tool paths, public web-service paths, and direct generation. To keep the acceptance test controlled, the task later in this guide explicitly forbids package installation and network access and asks for the direct custom-generation fallback.

3. Read the security scan during installation

For a first install where you need to read the scan and make a human decision before any files are copied, use the interactive terminal with the exact identifier returned by search:

hermes skills install official/creative/ascii-art

The official implementation fetches the bundle into quarantine and runs the security scanner. Once policy allows the bundle, the ordinary interactive CLI asks for confirmation before copying it into the local Skills directory; this is the route that provides a real “read the report, then decide” pause. The labels may change between versions, but the decision order should not:

• read the verdict;
• inspect every finding, including its file and risk type;
• decide whether that behavior matches the Skill’s stated purpose;
• stop when a high-risk or unexplained action remains.

Do not make forced installation the default response to a scan you do not understand. The scan is an installation gate, not a guarantee about every external dependency, service policy, or generated result. After installation, you still need to identify the effective copy, apply audit only where it is in scope, and run the minimal task.

Install in the current chat and apply immediately

Inside a Hermes chat, use:

/skills install official/creative/ascii-art --now

This route has a different consent boundary. The /skills install slash action calls the installer with skip_confirm=True because the chat UI cannot pause for terminal-style input; typing the command is treated as implicit consent. The scanner can still block a disallowed bundle, but when policy allows it there is no post-scan human confirmation point before copying. Do not choose the chat command expecting to read findings and then cancel. For a first review, use the interactive CLI and start a new session afterward.

--now belongs to the chat command /skills install; it is not a documented option to append to hermes skills install. It only invalidates the current Skills prompt cache so the reviewed installation becomes available immediately—it does not add a confirmation step. Use it only after you have reviewed and accepted the exact source and version. The official guide notes that rebuilding this context costs more tokens on the next turn.

4. Activate the Skill in the correct session

A normal CLI installation is safest to consume from a new session. A conversation that was already open can retain the Skills index built at its start, so seeing a directory on disk does not prove that the old session knows the new slash command.

Choose one route:

• Default: end the current chat and start a new session; where supported, /reset creates a fresh session.
• Immediate in the current chat: only after reviewing the exact source and version and accepting the chat command’s implicit install consent, run the chat form with --now so the cache is invalidated immediately.

Keep two states separate: “the files exist under ~/.hermes/skills/” and “this session has loaded the Skill.” Confusing them is the usual cause of an installation that appears successful but remains invisible in chat.

5. Verify discovery, audit status, and command registration

In a terminal, check the local index and re-scan the installed content:

hermes skills list
# Run this only when ascii-art is recorded in the Hub lock file:
hermes skills audit ascii-art

The list establishes discovery and helps identify the effective source. audit only enumerates installations recorded by HubLockFile: with none it reports No hub-installed skills to audit, and for a non-Hub name it reports that it is not a hub-installed skill. Those messages are not evidence of corruption, and they do not mean the visible copy has been scanned.

If a same-named project copy shadows the Hub copy, audit still scans the lock-file path under the profile-local Skills directory while /ascii-art loads the project copy. Confirm the effective path and review that copy’s complete SKILL.md and support files; do not cite the Hub audit as proof that the executed content was checked. Choose another unshadowed official optional Skill when you need to exercise the complete Hub installation flow. For an applicable Hub installation, repair missing files, an invalid path, or high-risk findings before attempting the task.

Next, in a new session or one refreshed with --now, invoke the command explicitly:

/ascii-art

Explicit invocation is better than natural-language routing for the first acceptance test because it removes one variable. If Hermes recognizes the slash command and asks for a task, session registration is working.

6. Run one practical task and save the output

Send this minimal task in the same session:

/ascii-art Use the custom generation fallback to create a banner spelling HERMES with ASCII characters only. Do not install packages or use network services. Return exactly one fenced text block, no more than 60 characters wide and 15 lines high.

This is a synchronous chat task. It does not produce a job ID and needs no polling. Wait for the same response to finish, then save only the content inside the fenced block as:

hermes-ascii.txt

Save this validator as validate_ascii.py:

from pathlib import Path

path = Path("hermes-ascii.txt")
text = path.read_text(encoding="utf-8")
lines = text.splitlines()
width = max((len(line) for line in lines), default=0)
ascii_only = text.isascii()
print({"lines": len(lines), "max_width": width, "ascii_only": ascii_only})
raise SystemExit(not (lines and len(lines) <= 15 and width <= 60 and ascii_only))

Then run:

python validate_ascii.py

The task passes only when all of these are true:

• the current session recognizes /ascii-art;
• the reply contains exactly one text block to save;
• HERMES is recognizable in the banner;
• hermes-ascii.txt is not empty;
• the script reports at most 15 lines, a maximum width of 60, and ascii_only: True, then exits with code 0;
• the Skill did not ask to install a package, access the network, or provide a credential.

The ASCII test is essential because the official custom fallback explicitly offers a Unicode box-and-block palette. Width, height, and readability alone would wrongly accept output such as HERMES ░. If ascii_only is False, send the same task again, require every non-ASCII character to be replaced, overwrite the file, and rerun the validator.

This contract is more useful than matching a screenshot. The letter shapes can vary while the invocation, saved artifact, and measurable limits stay stable.

7. Troubleshoot by symptom

Symptom	Check first	Fix and retest
Search returns nothing useful	Query or source filter may be too narrow	Broaden the terms, copy the full identifier from the new result, and inspect it
Inspect works but download fails	Upstream files may have moved, or the response may show a network or rate-limit problem	Search again instead of repeatedly guessing the path; use the current result if the index is stale
Installation is blocked by the scan	Read the verdict, file, and risk type for each finding	Stop, review the files, or choose another Skill; do not treat force as the normal fix
hermes skills list shows it, but /ascii-art is missing	The chat may have started before installation	Start a new session or /reset; next time, use the chat install form with --now when immediate use is required
Slash command works, but natural language does not trigger it	Routing may have selected no Skill or a different one	Use /ascii-art <task> explicitly first, then test natural-language routing separately
A same-named command loads unexpected content	The effective source/path may be a project copy while audit scanned only the Hub lock path	Check the nearest project root for .hermes/skills/ and .agents/skills/, then review the active copy; do not use the shadowed Hub audit as proof of /ascii-art content
The task asks for packages or a web call	The Skill selected pyfiglet, cowsay, or an online path	Repeat the acceptance prompt and require the custom fallback with no installation or network
A Hub install’s audit differs from the install-time result	Files at the Hub lock path may have changed or been updated	Stop using it, identify the change, audit again, and repeat the same minimal task
It is missing on another platform	The Skill may be disabled there or declare an incompatible platform	Check per-platform enablement and platforms, then start a fresh session on that platform

Change one variable at a time and rerun the same HERMES task. That identifies whether the failure is in discovery, installation, session loading, routing, or the Skill’s own procedure.

8. Choose Skills by task, not by a generic ranking

Instead of asking which Skill is “best,” ask:

1. Does it directly complete the job you have now?
2. Does inspect make dependencies, network use, file access, and permissions understandable?
3. Is its source traceable, and can you audit it again after an update?
4. Does the output have an observable success signal and a repeatable minimum test?
5. Can the procedure stop safely before writing to an external system when something fails?

For a first use, prefer small inputs, narrow permissions, and an output you can save. Move to Skills that need accounts, write access, or third-party services only after this workflow is familiar.

Final checklist

• Search produced a full identifier instead of a guessed path.
• inspect was treated as a truncated preview, and the complete SKILL.md plus support files were read from the exact source and version.
• When a human decision was needed before copying, the interactive CLI was used and the verdict and findings were read.
• A new session was used; chat --now was used only after full review and with its missing post-scan confirmation point understood.
• hermes skills list confirmed the effective source; hermes skills audit ascii-art was used only for an unshadowed Hub-recorded install.
• /ascii-art was invoked explicitly and hermes-ascii.txt was saved.
• The dimension, ASCII-only, and human readability checks all passed.
• Any failure was assigned to one layer, fixed, and retested with the same task.

At this point, you have proved more than the existence of an installation directory. You have shown that the Skill can be found, understood, admitted through the installation gate, loaded into a session, used for a real task, and checked through a saved result.

Official references

• Working with Skills
• Optional Skills
• ASCII Art Skill
• Skills System