From beffeea053787cabec5cb67fa0d8dfd2381d4502 Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Tue, 7 Jul 2026 16:36:37 -0700
Subject: [PATCH] feat(skills-hub): add K-Dense scientific-agent-skills as a
 default community tap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Registers K-Dense-AI/scientific-agent-skills (~150 MIT-licensed scientific
research skills — ML training/eval, computational biology, cheminformatics,
physics, scientific databases) as a DEFAULT_TAPS entry so the skills are
discoverable and installable via 'hermes skills search/install' without any
per-user tap setup.

Deliberately NOT added to TRUSTED_REPOS: it resolves at 'community' trust, so
the security guard scans every skill and INSTALL_POLICY only auto-installs the
ones rated 'safe'. The skills wrap third-party tools whose own licenses vary
(some GPL; KEGG needs a commercial license for non-academic use) — those terms
are surfaced per-skill and are the installer's concern at use time, not vetted
here. Nothing is vendored into the tree; the upstream repo stays the source.
---
 tools/skills_hub.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/tools/skills_hub.py b/tools/skills_hub.py
index 9883b720ee0..f81501712fa 100644
--- a/tools/skills_hub.py
+++ b/tools/skills_hub.py
@@ -525,6 +525,19 @@ class GitHubSource(SkillSource):
         # https://github.com/NVIDIA/skills/tree/main/skills
         {"repo": "NVIDIA/skills", "path": "skills/"},
         {"repo": "garrytan/gstack", "path": ""},
+        # K-Dense-AI/scientific-agent-skills: ~150 scientific research skills
+        # (ML training/eval, computational biology, cheminformatics, physics,
+        # scientific databases). MIT-licensed skill content; the flat
+        # skills/<name>/ layout matches the anthropic/huggingface taps. This is
+        # a community tap on purpose — it is deliberately NOT in
+        # tools/skills_guard.py::TRUSTED_REPOS, so it resolves at "community"
+        # trust: the security guard still scans every skill and INSTALL_POLICY
+        # only auto-installs the ones it rates "safe". Individual skills wrap
+        # third-party tools whose OWN licenses vary (some GPL, KEGG needs a
+        # commercial license for non-academic use); those terms are the
+        # installer's concern at use time and are surfaced in each skill's own
+        # frontmatter/Prerequisites, not vetted here.
+        {"repo": "K-Dense-AI/scientific-agent-skills", "path": "skills/"},
     ]
 
     def __init__(self, auth: GitHubAuth, extra_taps: Optional[List[Dict]] = None):