skillhub: A Self-Hosted Registry and Governance Platform for Private Agent Skills

Once a team outgrows ad-hoc skill sharing, three questions come up: where do proprietary skills live, who can publish them, and how do you audit changes? iflytek/skillhub answers all three with a self-hosted registry that runs on your infrastructure, not a vendor SaaS.

Why This Skill Matters

SkillHub is explicitly framed as a registry and governance platform — not a curated skill collection. It is complementary to open catalogs. Teams publish their own skill packages, push them to a private registry, and let others find them via search or install via CLI. The repository positions itself for enterprise use: self-hosted with full data sovereignty, RBAC per namespace (Owner/Admin/Member), audit logs for governance actions, scoped API tokens with prefix-based secure hashing, pluggable S3/MinIO storage, and a Prometheus + Grafana monitoring stack.

Skills are not executed by SkillHub — it is infrastructure only. The CLI ships a compatibility layer for ClawHub-style clients so existing tooling keeps working, while native CLI APIs are the primary supported path.

The release ships for linux/amd64 and linux/arm64. Document skills from anthropics/skills (DOCX/PDF/PPTX/XLSX) are flagged as source-available rather than open source in the README.

Installation

There are four install paths. Pick by environment.

Quick start on a single host:

curl -fsSL https://imageless.oss-cn-beijing.aliyuncs.com/runtime.sh | sh -s -- up

Local development (Docker Compose via Makefile):

make dev-all

Manual Compose deployment (production-like):

cp .env.release.example .env.release
make validate-release-config
docker compose --env-file .env.release -f compose.release.yml up -d

Kubernetes / Helm:

helm upgrade --install skillhub ./charts/skillhub \
  --namespace skillhub \
  --create-namespace \
  -f values-production.yaml

For local development only, mock-auth users (local-user, local-admin) exist in the local profile. Use make test-backend-app to run the backend tests; running ./mvnw -pl skillhub-app clean test directly under server/ can produce misleading errors.

Real Workflow: Publish a Skill to a Team Namespace

You have a skill your team built (my-skill) and want to publish it to your team's namespace on SkillHub so colleagues can install it without seeing anything outside the namespace.

Step 1. Make sure your my-skill directory has a SKILL.md and any references / templates the README expects.

Step 2. Authenticate the CLI against your SkillHub instance (use whatever token issuance flow your admin set up — the registry issues scoped tokens with prefix-based hashing).

Step 3. Publish to your team's namespace with semantic versioning:

npx clawhub publish ./my-skill \
  --slug my-team--my-skill \
  --version 1.0.0

The double-dash in --slug separates the namespace from the skill name. SkillHub treats the my-team-- prefix as a visibility boundary enforced by RBAC.

Step 4. Tag the version with a stability marker:

npx clawhub publish ./my-skill \
  --slug my-team--my-skill \
  --version 1.1.0 \
  --tag beta

The README documents beta and stable as the two canonical tag options, with latest tracked automatically.

Step 5. Verify a colleague can install it. Have a teammate run:

npx clawhub install my-team--my-skill

If their role in my-team permits it, the install succeeds. If their role is Member and your namespace requires Admin approval for new skills, the install blocks until an Admin approves.

Real Workflow: Roll Out SkillHub to a Kubernetes Cluster

You are rolling SkillHub out for a small platform team that wants full data sovereignty. Use the Helm chart.

Step 1. Render the chart's defaults once to inspect what gets installed:

helm template skillhub ./charts/skillhub > rendered.yaml

Verify the rendered manifests include a Deployment, Service, ConfigMap, and the RBAC objects for the namespace.

Step 2. Create your values-production.yaml overriding the storage backend to use your existing S3 (or MinIO):

storage:
  backend: s3
  s3:
    bucket: my-skillhub-bucket
    region: us-east-1
    accessKeySecretRef: my-skillhub-s3-creds

Step 3. Install with the production values file:

helm upgrade --install skillhub ./charts/skillhub \
  --namespace skillhub \
  --create-namespace \
  -f values-production.yaml

Step 4. Set up observability. The README's monitoring stack is Prometheus + Grafana; configure scraping for the SkillHub endpoints (the rendered ConfigMap exposes the metrics path).

Step 5. Wire the registry into your agents. SkillHub-compatible clients use the CLAWHUB_REGISTRY environment variable to point at your instance. For Hermes Agent, install skills into $HERMES_HOME/skills/ via clawhub install --dir. For HarnessClaw Engine, install into ~/.harnessclaw/workspace/skills/ the same way.

Tips

• Treat SkillHub as registry infrastructure, not a skill collection. Pair it with an open catalog (e.g. heilcheng/awesome-agent-skills) for discovery and use SkillHub for hosting the proprietary subset.
• Use semantic versioning from day one; the README treats semver as the contract that RBAC and audit log review against.
• Pick namespace boundaries carefully — they double as access control, so renaming them later is a breaking change.
• Wire Prometheus + Grafana scraping from the start; the audit log is only useful if you can query and alert on it.
• For OpenClaw/Hermes/HarnessClaw/AstronClaw/Loomy/astron-agent clients, the env var or --dir flag is the integration point. Native CLI APIs are preferred over the compatibility layer.

When Not to Use This

If you do not need governance, RBAC, audit logs, or self-hosting, an open catalog with a hosted registry (or a plain npx skills add <owner>/<repo> workflow) is simpler and faster. SkillHub pays off when proprietary skills need to live behind your firewall and your platform team needs auditable publish/review workflows.

See the leaderboard for more self-hosted skill registries.