DOCSEARCHbyAlgolia
Submit Docs

SkillHub Documentation

repository·main·Indexed 26 days ago

https://github.com/iflytek/skillhub

SkillHub is an enterprise-grade, self-hosted registry for agent skills that allows organizations to publish, version, and govern reusable skill packages for AI coding agents. It features a microservices architecture deployed on Kubernetes via Helm, supporting high availability, external database integration (PostgreSQL and Redis), S3 object storage, and a CLI for managing local skill inventories.

Tokens
214.2K
Snippets
452
Records
1.2K
Agent score
63%

What's inside SkillHub

  1. Overview of Agent Platform Integrations

    main

    SkillHub supports several agent platforms:

    • OpenClaw: Open-source agent skill CLI that uses SkillHub as a registry.
    • Hermes Agent: Uses SKILL.md format and discovers skills in $HERMES_HOME/skills/.
    • HarnessClaw Engine: Go LLM programming assistant that loads skills from SKILL.md with YAML frontmatter.
    • AstronClaw: Cloud AI assistant (via WeChat Work, DingTalk, Feishu) that can connect to a self-hosted SkillHub registry for one-click installation and management.
    • Loomy: Desktop AI work partner that integrates with SkillHub to discover organization-specific skills for local automation.
    • astron-agent: iFlytek Astron agent framework that references and loads skills from SkillHub for governed lifecycle management.

  2. Overview of SkillHub features and capabilities

    main

    SkillHub is an enterprise-grade AI skill registration platform designed for publishing, discovering, and managing skills. It uses a self-hosted architecture to ensure data security. Key capabilities include:

    • Release Management: Supports Semantic Versioning, custom tags (e.g., beta, stable), and an automatic latest tag for the most recent version.
    • Discovery Mechanism: Features full-text search, multi-dimensional filtering (namespace, download count, rating), and visibility controls (Public, Namespace-specific, or Private).
    • Organizational Structure: Provides namespace isolation, Role-Based Access Control (RBAC), and a dual-layer space model (Team and Global).
    • Governance: Includes a two-layer audit process, audit logs, and separation of permissions.
    • Storage & Deployment: Supports S3, MinIO, or local storage, and is deployable via Docker or Kubernetes.

  3. Overview of Revoked API Token Validation Implementation Plan

    main

    The Revoked API Token Validation plan aims to enforce a 'fail-closed' Bearer token behavior for the SkillHub CLI API. The goal is to ensure that if a Bearer token is provided but is invalid or revoked, the system fails closed rather than falling back to a Web Session.

    Authentication Logic:

    • Valid Bearer Token: Replaces the Web Session.
    • Invalid Bearer Token: Fails closed (no Web Session fallback).
    • Absent or non-Bearer Authorization: Preserves the existing Web Session and allows public reads to remain anonymous.

    Architecture Strategy:

    • ApiTokenAuthenticationFilter remains the sole entry point for Bearer authentication.
    • Spring Security's existing Web Session identity is preserved for non-Bearer requests.
    • Implementation relies on a credential-state matrix tested via Spring Boot/MockMvc with real token/user persistence and deterministic controller-service stubs.

  4. Overview of SkillHub Phase 2 Backend Architecture

    main

    Phase 2 of the SkillHub backend implements Namespace management and the core Skill lifecycle. This includes database migrations, object storage, namespace management, skill publishing/querying/downloading, tag management, search, asynchronous events, and rate limiting. The architecture is divided into several specialized modules:

    • skillhub-app: Contains the web and CLI controllers, DTOs, and configuration (Async, Rate Limiting).
    • skillhub-domain: Defines the core domain entities (Namespace, Skill, SkillVersion, etc.), services, and validation logic.
    • skillhub-storage: Provides an SPI for object storage, supporting LocalFileStorageService and S3StorageService.
    • skillhub-search: Provides an SPI for search functionality, with a PostgreSQL full-text search implementation.
    • skillhub-infra: Handles JPA repository implementations.

  5. Overview of SkillHub

    main

    SkillHub is an enterprise-grade Agent Skill Registry designed to manage AI skill packages using a workflow similar to npm. It provides centralized management for publishing, versioning, discovering, and securing AI skills within an organization.

    Key Capabilities:

    • Skill Publishing & Version Management: One-click publishing with semantic versioning, tagging, and support for multiple concurrent versions.
    • Skill Search & Discovery: Full-text search and smart filtering with permission-aware results.
    • Namespace & Team Management: RBAC (Role-Based Access Control) via namespaces with Owner, Admin, and Member roles.
    • Review & Governance: Multi-level review workflows and reporting for quality assurance.
    • Security Scanning: Built-in Skill Scanner with multi-engine analysis to detect malicious code and security risks.
    • Enterprise Self-Hosting: Supports Docker Compose and Kubernetes (K8s) for complete data sovereignty.

  6. Overview of SkillHub

    main
    SkillHub is a self-hosted Agent Skill registry designed for enterprise environments. It acts as a private, controllable registry for managing Agent Skill packages, similar to how npm or PyPI manages software packages. It enables teams to discover, reuse, and manage skills through a centralized system with version control, security scanning, and namespace-based permissions.

  7. Overview of SkillHub features and value

    main

    SkillHub is an enterprise-grade AI skill registry designed for secure and controllable skill publishing, discovery, and management.

    Key Capabilities:

    • Data Sovereignty: Self-hosted deployment with support for private S3/MinIO storage and full audit trails.
    • Governance: Namespace isolation, two-layer review mechanisms, and fine-grained RBAC (Role-Based Access Control).
    • Integration: Compatible with ClawHub CLI, provides standard REST APIs, and supports OAuth2 enterprise SSO integration.
    • Observability: Complete audit logs, Prometheus metrics, and operation tracing.

    Core Features:

    • Version control and semantic versioning.
    • Full-text search and multi-dimensional filtering.
    • Namespace management and audit logging.

  8. Understand the scope of SkillHub audit logs

    main

    SkillHub maintains audit logs for all critical operations to ensure enterprise compliance. The following types of actions are recorded:

    • Skill lifecycle: publishing, downloading, and deleting skills.
    • Review processes: approving or rejecting skills.
    • User sessions: logging in and logging out.
    • Access control: permission changes.
    • Governance: namespace management.
    • System configuration: configuration changes.

  9. Manage Namespaces and Team Roles

    main

    Namespaces are the core organizational units in SkillHub, representing a team or project with independent members, permissions, and skill packages. They provide isolation between teams, Role-Based Access Control (RBAC), and governance capabilities.

    Roles and Permissions

    RolePermissions
    OwnerFull control, including deleting the namespace and managing all members
    AdminManaging members, auditing skill packages, and modifying settings
    MemberPublishing skill packages and viewing private skill packages

    Namespace States

    • Active: Normal operation.
    • Frozen: No new skill packages can be published, but existing versions remain downloadable.
    • Archived: Hidden from search results, but existing skill packages remain accessible.

  10. Definition of Done for Private SSO integration

    main

    A Private SSO integration is considered complete when it meets these criteria:

    • The open-source default login method remains unchanged.
    • The private version integrates via extension points without duplicating the login architecture.
    • direct auth is functional.
    • session bootstrap is functional.
    • Automatic account creation occurs on the first SSO login.
    • Web login states are unified using Spring Session Redis.
    • Existing business interfaces (e.g., /api/v1/auth/me, RBAC) are agnostic of the login source.
    • Documentation, configuration, and tests are complete.

  11. Understand Skill Scanner workflow and behavior

    main

    Workflow

    1. Developer publishes a skill package.
    2. SkillHub backend receives the upload.
    3. Security scanning is triggered asynchronously via Redis Stream.
    4. Skill Scanner executes multi-engine analysis (Metadata, Behavior, LLM, etc.).
    5. Results are written to the database.
    6. The scan report is displayed on the skill package details page for administrator review.

    Key Behaviors

    • Asynchronous Execution: Scanning does not block the skill package upload process. Results appear on the details page once completed.
    • Analysis Engines:
      • Metadata Analysis: Checks package structure, file types, and size (Enabled by default).
      • Behavior Analysis: Analyzes code patterns for malicious operations (Optional).
      • LLM Analysis: Uses Large Language Models for security analysis (Optional).
      • AI Defense: Cisco AI Defense integration (Optional).
      • VirusTotal: Virus scanning (Optional).

  12. Implement AI skill governance and compliance

    main

    For industries with strict compliance requirements (such as finance or government), SkillHub supports the following governance mechanisms:

    • Two-layer approval process: Skills undergo both team-level and platform-level reviews.
    • RBAC (Role-Based Access Control): Fine-grained permission management.
    • Audit Logs: Complete operational audit trails for all actions.
    • Version Control: Skill versions are traceable and can be withdrawn/recalled.