Introduction
Once a skill works for you, sharing it is mostly a packaging decision. Hermes does not have a centralized publish command. Instead it integrates a handful of distribution shapes: custom GitHub taps, direct URLs, well-known endpoints, marketplaces. Each shape fits a different audience and a different trust model. Pick the one that matches your reach.
Key Concepts
- Custom GitHub tap: A GitHub repo that holds many skills. Subscribers run
hermes skills tap add <owner/repo>and get all of them. - Direct URL: A single
SKILL.mdhosted at any HTTPS URL. Subscribers runhermes skills install <url>. - Well-known endpoint: A site that publishes
/.well-known/skills/index.json. Subscribers runhermes skills search <url> --source well-known. - Marketplace: A registry like skills.sh, LobeHub, or ClawHub that lists skills with discoverable metadata.
- Trust: Community by default for taps, URLs, well-known. Trusted for the small known list of taps (
openai/skills,anthropics/skills,huggingface/skills).
Real World Context
A platform team publishes their team-internal runbooks via a private GitHub tap (my-org/hermes-skills). Engineers add the tap, install runbooks, and the team can update them with regular Git workflows. The same team open-sources one general-purpose skill (pg-explain-review) by publishing it on skills.sh. A solo developer publishes their personal git-commit-style skill as a direct URL on their blog so any reader can install it in one line. Three distribution shapes, three audiences, all from the same standard.
Deep Dive
The most flexible distribution is a custom GitHub tap. The repo layout is small:
textmy-org/hermes-skills ├── README.md └── skills/ ├── deploy-runbook/ │ └── SKILL.md ├── pg-explain-review/ │ ├── SKILL.md │ └── references/ │ └── lock-modes.md └── release-notes/ └── SKILL.md
The skills/ path is the default; you can configure a different path per-tap if needed. Each subdirectory is one skill. The directory name becomes the install slug.
Subscribers add the tap once:
bashhermes skills tap add my-org/hermes-skills hermes skills search release hermes skills install my-org/hermes-skills/release-notes
For a single-skill direct URL, drop the file anywhere HTTPS-reachable:
bash# Publisher: just host the file # https://example.com/git-commit-style/SKILL.md # Subscriber: install with the URL hermes skills install https://example.com/git-commit-style/SKILL.md hermes skills install https://example.com/SKILL.md --name my-skill
Direct URLs are single-file only. If your skill has scripts or references, use a GitHub tap instead.
For a well-known endpoint, you publish /.well-known/skills/index.json on your site. Hermes can discover and install from it:
bashhermes skills search https://your-docs.example.com --source well-known hermes skills install well-known:https://your-docs.example.com/.well-known/skills/your-skill
This shape is best for vendors who already have a docs site and want skill discovery to follow the same URL.
For wider reach, publish to skills.sh, ClawHub, or LobeHub. Each has its own onboarding flow, but the underlying skill format does not change. The same SKILL.md that works as a tap entry works as a marketplace entry.
A few sharing considerations:
- Trust starts at community for everything you publish. Subscribers will see a third-party warning panel on first install. That is appropriate. The exception is the small set of repos hardcoded to
trustedtrust (openai/skills,anthropics/skills,huggingface/skills). - Versioning is your responsibility. Bump the
versionfield in yourSKILL.mdwhen you change behavior. Subscribers runninghermes skills checkwill see drift and decide whether to update. - Document prerequisites loudly. If your skill requires an env var, a specific toolset, or an MCP server, say so in both the frontmatter and the body. Subscribers should not have to read your code to figure that out.
- Pin a license. Add a LICENSE file to the tap repo so subscribers know the legal status.
Common Pitfalls
- Sharing without versioning: Subscribers cannot tell if a skill changed. Bumping
versionis two characters and saves confusion. - Bundling secrets: Never commit API keys, even into private taps. Use
required_environment_variablesand let subscribers provide their own.
Best Practices
- Start with a private tap: It is the simplest path and gives you full review control. Move to a public marketplace only when you have a skill stable enough to deserve wider reach.
- Treat the README as a directory: One line per skill linking to its
SKILL.md. Reviewers can scan the whole tap in seconds.
Summary
- Hermes has no single publish command; distribution is a packaging choice.
- Custom GitHub taps are the most flexible: many skills, one subscribe command.
- Direct URLs distribute single-file skills via HTTPS.
- Well-known endpoints embed skill discovery in an existing docs site.
- Marketplaces (skills.sh, ClawHub, LobeHub) extend reach but use the same
SKILL.mdformat.
Code Examples
# Publishing a tap (the publisher's perspective)
cd ~/code
git init my-org-hermes-skills
cd my-org-hermes-skills
mkdir -p skills/release-notes skills/pg-explain-review
# ... copy SKILL.md files in ...
git add . && git commit -m 'initial tap'
gh repo create my-org/hermes-skills --public --source=. --remote=origin
git push -u origin main
# Subscribing (anyone running Hermes)
hermes skills tap add my-org/hermes-skills
hermes skills list --source hub
hermes skills install my-org/hermes-skills/release-notes
# Update flow (publisher pushes, subscribers pull)
hermes skills check
hermes skills update