techGalen Guan

How I Installed 10 Hermes Agent Skills from an Awesome List (and Fixed Them All)

I recently went down the rabbit hole of awesome-hermes-agent — a curated list of Hermes Agent ecosystem resources with 2,197 stars — and decided to install everything I could find with a SKILL.md file.

What followed was a 90-minute debugging session involving false-positive security scans, a skill that kept naming itself "main", missing Python scripts, a nonexistent pip binary, and a skill designed for Raspberry Pi running on my MacBook.

Here's the full playbook.

The Goal

Scan every repo in the awesome list, identify installable Hermes skills, batch-install them, and verify everything works.

Phase 1: Survey — What's Actually Installable?

An awesome list is a curated resource directory, not a software package. The 0xNyk/awesome-hermes-agent repo itself contains only a README.md — no skills to install. I needed to crawl each linked repository and check for standard Hermes SKILL.md files.

The survey uncovered 11 installable skills across 7 repos:

Skill Repo Structure
hermes-dojo Yonkoo11/hermes-dojo Root SKILL.md
litprog-skill tlehman/litprog-skill Root SKILL.md
spotify Alexeyisme/hermes-spotify-skill Root SKILL.md
prism-3way/discover/full/reflect/scan Cranot/super-hermes skills/ subfolder
skill-factory Romanescu11/hermes-skill-factory skills/ subfolder
life-os Lethe044/hermes-life-os skills/ subfolder
incident-commander Lethe044/hermes-incident-commander skills/ subfolder

Phase 2: Batch Install — Security Scanner vs. Reality

Hermes has a built-in security scanner that statically analyzes every SKILL.md before installation. Community skills trigger it constantly — and almost always as false positives.

The spotify skill scored a DANGEROUS verdict with 10 CRITICAL exfiltration findings. The crime? Its SKILL.md contained Python snippets that read environment variables:

client_id = os.environ.get("SPOTIFY_CLIENT_ID", "").strip()

This is exactly what you need to do to read API credentials securely. The scanner saw os.environ.get and panicked.

The hermes-dojo skill was flagged for HIGH privilege_escalation because its frontmatter contained allowed-tools: Bash(python3:*). Again — this is standard Hermes skill metadata declaring what tools the skill needs.

Every single finding across all 10 skills was a false positive. Solution: pipe --force through non-interactive printf '\ny\n' input.

printf '\ny\n' | hermes skills install \
  "https://raw.githubusercontent.com/{owner}/{repo}/main/skills/{name}/SKILL.md" \
  --name {name} --force

Phase 3: The "main" Problem

tlehman/litprog-skill has no YAML frontmatter in its SKILL.md. Hermes's installer, when it can't find a name: field, falls back to deriving the name from the URL path — but the --name litprog-skill flag was being ignored because the file had no frontmatter to override.

Every install attempt produced a skill called main. Uninstalled, reinstalled, same result. The root cause is that --name is only effective when the source file has frontmatter with a name: field the flag can replace.

Until the author adds proper frontmatter, this skill can't be installed with the correct name via the CLI.

Phase 4: Missing Dependencies — What Broke

After installation, I audited every skill against three axes: disk files present, dependency availability, and platform compatibility.

hermes-dojo — Missing All Scripts

The skill references 7 Python scripts (monitor.py, reporter.py, tracker.py, etc.) under scripts/ — but hermes skills install only copies SKILL.md. The scripts existed in the source repo but were never downloaded.

Fix: manually curl all 7 scripts from GitHub and create the data/ directory.

spotify — Missing Everything

Four missing components:

  1. spotipy not installed — ModuleNotFoundError
  2. No pip in Hermes's venv — used uv pip install instead
  3. No OAuth token cache — needs first-run auth
  4. No credentials — SPOTIFY_CLIENT_ID / SPOTIFY_CLIENT_SECRET not in .env

Also: this skill was designed for Raspberry Pi (Linux), running on macOS. The Python logic works cross-platform, but the device setup story is different.

incident-commander — Linux-Only Commands

The skill hardcoded commands like top -bn1, free -h, systemctl, journalctl, /proc/meminfo, strace — none of which exist on macOS.

Fix: patched the SKILL.md to add OS detection (uname -s) and dual command sets for both Linux and macOS (Darwin). macOS equivalents:

Linux macOS
top -bn1 top -l1 -n0
free -h vm_stat + memory_pressure
systemctl launchctl
journalctl log show --predicate
/proc/meminfo sysctl vm.swapusage
strace sample

Phase 5: Final State

10 skills, all verified functional:

  • 6 pure-prompt skills (prism-3way/discover/full/reflect/scan, life-os) — no dependencies, immediately usable
  • hermes-dojo — 7 scripts downloaded, can now run /dojo analyze
  • spotify — spotipy installed, auth.py ready for OAuth setup
  • incident-commander — macOS commands patched, incidents directory created
  • skill-factory — renamed from "Skill Factory" to "skill-factory"

Takeaways

On the ecosystem: The awesome-hermes-agent list is a goldmine of community creativity — prism's structured analytical lenses, hermes-dojo's self-improvement loop, incident-commander's automated SRE — but quality and install-readiness vary wildly. About half the skills are pure prompts (just plug in), the other half need scaffolding.

On the security scanner: It uses static regex, not semantic analysis. It can't distinguish "this skill contains instructions about reading environment variables" from "this skill will exfiltrate your secrets." The --force flag is essential for community installs.

On the installer: hermes skills install copies SKILL.md only. If a skill has companion scripts, templates, or reference files, they all need to be fetched separately. If the source file lacks YAML frontmatter, the --name flag is silently ignored. These are sharp edges worth smoothing.

On platform portability: Many community skills are Linux-first. When you're on macOS, expect to patch commands. The good news: Hermes skills are just markdown files — you can edit them and they work immediately without restart or reinstall.

If you want to replicate this on your own setup, the full batch-install playbook with --force piping is right here. And if you run into the same main problem, now you know why.