---
name: shared-skills-manager
description: Manage shared read-only skills across all users via external_dirs.
version: 1.0.0
author: Admin, Hermes Agent
license: MIT
platforms: [linux, macos]
metadata:
  hermes:
    tags: [skills, devops, multi-user, permissions, external-dirs]
    related_skills: [hermes-agent, hermes-agent-skill-authoring]
---

# Shared Read-Only Skills Manager

## Overview
This skill defines and automates the deployment of system-wide skills accessible to all users and profiles in Hermes while enforcing strict read-only permissions at the file-system level so regular users cannot modify or overwrite them.

## Key Architecture
1. **Source of Truth Directory:** `/opt/shared-skills/`
   - All shared skills (or cloned git repos of skills) reside here.
   - Directory structure: `/opt/shared-skills/<category-or-name>/<skill-name>/SKILL.md`
2. **Global Hermes Injection:**
   Configured in `~/.hermes/config.yaml` (and `/home/*/.hermes/config.yaml`):
   ```yaml
   skills:
     external_dirs:
       - /opt/shared-skills
   ```
3. **Immutability Enforcement:**
   Directories: `755` (`rwxr-xr-x`)
   Files: `444` (`r--r--r--`) — read-only for root and all system users.

## How to Deploy a New Shared Skill

### Step 1: Create or Clone the Skill
```bash
mkdir -p /opt/shared-skills/<category>/<skill-name>
# Create SKILL.md or clone from git repo
```

### Step 2: Lock File Permissions
Always lock permissions after creating or updating:
```bash
chmod -R 755 /opt/shared-skills
find /opt/shared-skills -type f -exec chmod 444 {} +
```

### Step 3: Verify Hermes Config
Ensure `skills.external_dirs` includes `/opt/shared-skills` in `~/.hermes/config.yaml`.
Restart or start a new Hermes session (`/reset`) to load the skills.

## Verification
- Test that normal write operations fail: `touch /opt/shared-skills/test` should fail if not root, or test file editing.
- Confirm discovery via `hermes skills list`.