SkillHub
A private enterprise registry for publishing, governing, and distributing agent skill packages.
- Source repo
- iflytek/skillhub
- Stars
- ★ 5.4k
- Last updated
- 1d ago
- License
- Apache-2.0
- Primary language
- Java
- FA score
- 56/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex
- Cost
- Free, no paid service needed
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- An enterprise platform team distributing internal coding, documentation, or office-automation skills can publish them to private namespaces and let colleagues install them with the CLI.
- Not a fit if
- Individuals who just want to install skills without running a server and database
- Teams that need a fully offline setup with no PostgreSQL, Redis, or S3 dependencies
- Teams that want a vendor-hosted SaaS instead of operating it themselves
- Source review
- 56/100 · Major gaps
What does this agent do, and when should you use it?
SkillHub is a self-hosted registry for publishing, finding, installing, and managing reusable agent skill packages. It exposes a React 19 web UI, REST API, and CLI, backed by a Java 21 Spring Boot service with PostgreSQL, Redis, and local or S3/MinIO storage. Teams organize packages in namespaces with Owner, Admin, and Member roles, publishing policies, review flows, and audit logging for governance actions. Packages support semantic versions, beta and stable tags, and automatic latest tracking. The service can run with Docker Compose or Kubernetes/Helm and can serve as a registry backend for clients such as OpenClaw.
A publisher uploads a skill package to a namespace; SkillHub validates package contents against the default extension allowlist in SkillPackagePolicy.java and tracks semantic versions, tags, and a latest release. Users search from the web UI, REST API, or skillhub search, then use skillhub install to place a package in an agent target directory after authenticating with a scoped API token. Namespace membership roles and visibility rules determine what users can see and publish, while administrators review namespace releases and global promotions, with governance actions audit-logged. Nginx fronts the Spring Boot service, which uses PostgreSQL 16, Redis 7, and local filesystem or S3/MinIO package storage.
- An enterprise platform team distributing internal coding, documentation, or office-automation skills can publish them to private namespaces and let colleagues install them with the CLI.
- An AI governance team that needs an audit trail can apply namespace roles, review flows, and logged promotion actions before a skill enters the global scope.
- A development team using OpenClaw can point
CLAWHUB_REGISTRYat its own instance and search, install, and publish skills throughclawhub. - An organization using astron-agent can use SkillHub as a governed, versioned source for skills referenced and loaded by the framework.
- An operations team running internal services in Docker Compose or Kubernetes can deploy the registry from published images, Kubernetes manifests, or the Helm chart.
How do you install or deploy this agent?
The documented runtime prerequisites are Docker and Docker Compose. Start the published runtime images with:
curl -fsSL https://imageless.oss-cn-beijing.aliyuncs.com/runtime.sh | sh -s -- up --public-url https://skillhub.your-company.comFor production, provide the final HTTPS public URL and change the default bootstrap-admin password. Install the CLI with:
npm install -g @astron-team/skillhubYou then need an API token issued by the instance to sign in:
skillhub login --token sk_xxx --registry https://skill.xfyun.cnHow do you use this agent?
After login, verify the CLI and search for a package:
skillhub version
skillhub search pdfInstall a package for Codex:
skillhub install pdf-parser --agent codexList installed packages:
skillhub listFor OpenClaw, set CLAWHUB_REGISTRY=https://skillhub.your-company.com, then run npx clawhub search email or npx clawhub install my-skill.
What are this agent's strengths and limitations?
- It combines a web UI, native REST API, and CLI with a compatibility layer for ClawHub-style registry clients.
- Namespaces, Owner/Admin/Member roles, publishing policies, reviews, and audit logs provide concrete enterprise governance controls.
- Semantic versions, beta/stable tags, and automatic latest tracking support controlled package releases.
- Storage can use the local filesystem or S3/MinIO, and the repository provides Docker Compose, Kubernetes manifests, and a Helm chart.
- A full deployment depends on Docker Compose or Kubernetes plus infrastructure including PostgreSQL, Redis, and package storage.
- Production setup requires a public URL; the documented default bootstrap-admin password,
ChangeMe!2026, must be changed, rotated, or disabled before production use. - The ClawHub-style protocol compatibility layer is still expanding, while the README identifies native CLI APIs as the primary supported path.
- Package uploads are limited by a default file-extension allowlist; replacing it requires the
SKILLHUB_PUBLISH_ALLOWED_FILE_EXTENSIONSconfiguration.
How does this agent compare with similar options?
SkillHub identifies its native REST API and CLI as the primary supported path, while also offering compatibility for existing ClawHub-style registry clients so OpenClaw can use a self-hosted instance.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| SkillHub This agent | 56 · Major gaps | Self-hosted serviceFree | ★ 5.4k | 1d ago | Java | Codex |
| SandBase Harness | 52 · Major gaps | CLIFree + model costs | ★ 640 | 1d ago | TypeScript | OpenAI API · Claude API |
| Metorial: Identity & Access Layer for AI Agents | 50 · Major gaps | Library / SDKFreemium | ★ 3.4k | 1d ago | TypeScript | ChatGPT · Codex · Claude Code · Claude.ai |
| Nasiko Agent Control Plane | 39 · Major gaps | Self-hosted serviceFree + model costs | ★ 12k | 14d ago | Rust | OpenAI API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: RBAC, audit logs, API token management, upload extension allowlist, security defaults in Helm chart (e.g., rejecting default passwords, pinned image digests). Deductions: user confirmation mechanism not explicit (e.g., confirmation before publish/install), data flow transparency limited (no detailed data flow description), external effects (e.g., network calls) not fully documented.
Evidence shows: README consistent with Helm test scripts, dependencies (PostgreSQL, Redis, S3) clearly configured, failure messages (e.g., error messages in Helm tests) clear. Deductions: no specific evidence of runtime failure recovery.
Evidence shows: clear target audience (enterprise teams), capability boundaries (registry and governance platform), good environment fit (Docker, Kubernetes, Helm). Deductions: trigger precision (e.g., specific CLI command behavior) not detailed.
Evidence shows: clear information architecture (README, docs links), detailed install notes, stable naming (semantic versioning), rich examples (CLI commands, integration guides), clear license (Apache-2.0). Deductions: known limitations not explicitly listed, versioning changelog not provided, maintenance responsibility not clear (publisher unverified).
Evidence shows: high output usability (CLI, Web UI, API), clear marginal value (private registry, governance), reasonable cost-benefit (self-hosted, open source). Deductions: no specific performance or cost data.
Evidence shows: claims in README consistent with code and test scripts (e.g., Helm tests verify configuration), facts and inferences separated (e.g., architecture diagram vs implementation). Deductions: limited cross-source corroboration (only repository-internal evidence).
- Publisher identity unverified; exercise caution regarding supply chain risks.
- Default admin password (ChangeMe!2026) enabled in quickstart; must be changed in production.
- Quickstart script downloads and executes from external URL; supply chain risk, review recommended.
- Dependency image digests pinned, but need regular updates to patch vulnerabilities.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
cli-v0.3.1 CLI 0.3.1
Release notes excerpt
SkillHub CLI 0.3.1 Installation npm ```bash npm install -g @astron-team/[email protected] ``` From source Download and extract the archive, then: ```bash npm install -g . ``` Verify installation ```bash skillhub version ``` Changes See commit history for details.View on GitHub ↗ -
Release notes excerpt
SkillHub v0.2.25 This release adds Korean language support and permission-aware Suite discovery, improves device authorization configuration, and expands deployment and usage documentation. 🌟 Highlights - Use the Web interface in Korean, with browser-language detection and a persistent language preference. [#1021](https://github.com/iflytek/skillhub/pull/1021) - See related-Suite membership hints on skill cards, limited to Suites the current viewer can access. [#1022](https://github.com/iflytek/skillhub/pull/1022) …View on GitHub ↗ -
cli-v0.3.0 CLI 0.3.0
Release notes excerpt
SkillHub CLI 0.3.0 Installation npm ```bash npm install -g @astron-team/[email protected] ``` From source Download and extract the archive, then: ```bash npm install -g . ``` Verify installation ```bash skillhub version ``` Changes See commit history for details.View on GitHub ↗
FAQ
Can it be deployed entirely inside an enterprise environment?
Who can publish and approve skills?
What credential does the CLI need?
skillhub login --token sk_xxx --registry <registry-url>, and the platform supports scoped token management.Which skill clients are explicitly described?
--dir for Hermes Agent and HarnessClaw Engine. Its Codex installation example uses --agent codex.