codingsamss/hermes-skill-source-classification
platforms/hermes/skills/autonomous-ai-agents/hermes-skill-source-classification/SKILL.md
Diagnose Hermes `hermes skills list` source labels (`builtin` vs `local`) and avoid false sync decisions.
$ install --global
skillsauthnpx skillsauth add codingsamss/ai-dotfiles hermes-skill-source-classificationInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 17, 2026, 2:20 PM6.2s1 file scanned
SKILL.md
- name:
- hermes-skill-source-classification
- description:
- Diagnose Hermes `hermes skills list` source labels (`builtin` vs `local`) and avoid false sync decisions.
- version:
- 1.0.0
- author:
- Hermes Agent
- license:
- MIT
Hermes skill source classification
Use this when hermes skills list shows source=builtin for skills that also exist in local skill directories.
Key finding
Hermes source labeling is name-manifest based:
- if a skill name appears in
~/.hermes/skills/.bundled_manifest, the CLI may label it asbuiltin - this can happen even when a local copy exists at
~/.hermes/skills/<category>/<name>/
So builtin does not always mean “no local copy”.
Verification workflow
- Check label:
hermes skills list --source all | grep -E '<skill-name>'
- Check bundled manifest hit:
grep -nE '^<skill-name>:' ~/.hermes/skills/.bundled_manifest
- Check both physical paths:
test -f ~/.hermes/hermes-agent/skills/<category>/<skill-name>/SKILL.md && echo bundled_exists
test -f ~/.hermes/skills/<category>/<skill-name>/SKILL.md && echo local_exists
Sync decision rule
For repo/local sync scripts, do not use only --source local as truth.
Use a combined rule:
- source label
- local path existence
- repo path existence
Pitfall
A skill may be misclassified as repo-only if your script trusts source label alone. This can trigger unnecessary sync prompts.
Related Skills
codingsamss/mx-message-query
development
VerifiedTrustedCommunity
Query Midea MX / 美信 local message cache through the MX local HTTP query service from Codex. Use when the user asks to read MX sessions, search chat history, search messages globally or inside a group/session, list recent messages, or page message history. This is read-only and does not require send authorization. Never fall back to reading SQLite or app cache files directly.
8SKILL.mdUpdated Jun 5, 2026
codingsamss/mx-im
development
VerifiedTrustedCommunity
Safely search MX users or groups and send Midea MX / 美信 IM messages from Codex. Use when the user asks to notify someone, send a message to a person or group, use a configured group alias, @ users, @ all, or send MX file/image messages. Read lookups need no extra authorization; every live send needs explicit user authorization for that exact target and message.
8SKILL.mdUpdated Jun 5, 2026
codingsamss/mx-channel-rules
tools
VerifiedTrustedCommunity
MX channel output rules. Always active in MX conversations.
8SKILL.mdUpdated Jun 5, 2026
codingsamss/workspace-cli-bridge
tools
VerifiedTrustedCommunity
Use the company WorkSpace `ws` CLI reliably as a delegated coding agent from Codex. Trigger when the user wants Codex to command `ws`, WorkSpace CLI, or the company opencode-derived coding tool to generate code, inspect a repo, run a bounded implementation task, or use a requested WorkSpace model while Codex reviews the output.
8SKILL.mdUpdated Jun 4, 2026