hermes - 💡(How to fix) Fix [skills hub] openclaw-migration: search metadata and skill content disagree; trust level flips on install [1 participants]

Summary

When searching the skills hub for the openclaw-migration skill, the result lists it as Source: official, Trust: official. However, the inspect preview returns a SKILL.md whose content is unrelated to OpenClaw → Hermes migration — it describes an internal clawdbot/ → openclaw/ rename workflow. Attempting to install the same skill then reports it as community and flags it as DANGEROUS, refusing to install without --force.

The real openclaw-migration skill (the one that backs hermes claw migrate) exists at optional-skills/migration/openclaw-migration/ in the Hermes Agent repository and contains the expected content — but hermes skills install official/migration/openclaw-migration does not retrieve it.

Environment

• Hermes Agent v0.13.0 (2026.5.7) "Tenacity"
• macOS 26 (arm64, Apple Silicon)
• Installed via official scripts/install.sh

Reproduction

1. Run:

   hermes skills search openclaw

   Result (truncated, relevant row):

   Name                    Description                                Source     Trust       Identifier
   openclaw-migration      Migrate a user's OpenClaw                  official   official    official/migration/openclaw-…
                           customization footprint into Hermes...

2. Run:

   hermes skills inspect official/migration/openclaw-migration

   The metadata header confirms Trust: official and the expected description. But the SKILL.md Preview panel renders content that begins:

   # SKILL.md - OpenClaw Migration
   ## Purpose
   When the workspace is in the middle of renaming the Clawd project to OpenClaw, this skill lives in the repo so everyone—human or helper—can follow the same migration playbook...

   The rest of the body talks about clawdbot/ directory layout, pnpm workspaces, package.json scripts, and a contributor named "Ivan". This is unrelated to the OpenClaw → Hermes migration the slug suggests.

3. Run:

   hermes skills install official/migration/openclaw-migration

   Output:

   Fetching: official/migration/openclaw-migration
   Quarantined to .hub/quarantine/openclaw-migration
   Running security scan...
   Scan: openclaw-migration (openclaw-migration/community)  Verdict: DANGEROUS
     CRITICAL persistence    SKILL.md:12    "1. **Inventory current layout**: `clawdbot/` is the existing"
     CRITICAL persistence    SKILL.md:15    "- Pay special attention to `README-header.png`, `docs/*.md`,"
     CRITICAL persistence    SKILL.md:17    "4. **Move common metadata**: decide where `AGENTS.md`, `SOUL`"
   
   Decision: BLOCKED — Blocked (community source + dangerous verdict, 3 findings). Use --force to override.

4. Note that the real openclaw-migration skill (the one referenced by hermes claw migrate) is present at ~/.hermes/hermes-agent/optional-skills/migration/openclaw-migration/SKILL.md with the expected content (15,928 bytes, talks about importing memories, SOUL.md, secrets, etc.). That file is not what the hub returns.

What is inconsistent

• Search vs install trust mismatch. Search reports Source: official, Trust: official. Install reports openclaw-migration/community and applies community-source policy (blocks DANGEROUS verdicts by default).
• Metadata vs content mismatch. Description and identifier suggest the OpenClaw → Hermes migration skill. Content is an unrelated internal rebrand playbook.
• Hub vs local optional-skills disagreement. The same identifier official/migration/openclaw-migration exists in optional-skills/ with correct content, but the hub returns something else.

Probable cause

I cannot determine root cause without access to the hub adapter code, but the symptom pattern is consistent with one of:

• A name collision between OptionalSkillSource and another source (skills.sh, ClawHub) where the search result merges metadata from one and content from another.
• A cached or stale entry in the hub registry pointing at the wrong SKILL.md path.
• A historical artifact that was indexed before the current openclaw-migration skill was published.

Security implication

The security scanner's three CRITICAL persistence findings appear to be triggered by lines like Move common metadata: decide where AGENTS.md, SOUL.md... — these are descriptive text in a benign markdown document, not actual persistence operations. They look like false positives in this case.

But the broader concern is: if a hub query for an official skill can return content from a different artifact, a malicious actor could potentially inject content into search results that disagree with the metadata users trust. The trust level should be derived from the same source as the content, not separately.

Workaround

Use the local optional-skills/ copy directly. The hermes claw migrate command resolves to the correct script at ~/.hermes/hermes-agent/optional-skills/migration/openclaw-migration/scripts/openclaw_to_hermes.py once Hermes is installed from the official scripts/install.sh. Hub installation is not required for the migration to work.

Suggested check

• Verify that OptionalSkillSource is fetching the correct SKILL.md path for official/migration/openclaw-migration.
• Reconcile the search result trust level (official) with the install path verdict (community) so they reflect the same source resolution.
• Consider whether the security scanner's persistence pattern needs tightening to avoid flagging descriptive markdown.