skillhub
SkillHub is a self-hosted, open-source agent skill registry that lets organizations publish, version, govern, and distribute reusable “skill packages” within private namespaces. It provides a Web UI and CLI-first workflows plus a backend REST API, with RBAC and audit logging, and supports pluggable storage (filesystem, S3/MinIO).
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Security-relevant signals from README: HTTPS is implied for a production entrypoint; it includes RBAC, audit logs, scoped API tokens, and mention of password bootstrap defaults that must be changed/rotated. Explicit guidance on TLS enforcement, token hashing details, secure secret storage practices, rate limiting, and dependency vulnerability posture are not fully verifiable from the provided text.
⚡ Reliability
Best When
You need an on-prem registry with RBAC, auditability, versioning, and controlled distribution of reusable agent skills across teams.
Avoid When
You cannot provide the required infrastructure (Docker/K8s, PostgreSQL/Redis, object storage) or you need a fully managed SaaS experience.
Use Cases
- • Private, governed internal registry for agent/robot skill packages
- • Namespace-based discovery and installation of versioned skills (team/global scopes)
- • Enterprise publishing workflows with review, promotion gates, and audit logs
- • Integrating agent platforms/skill CLIs that can use a registry endpoint (e.g., OpenClaw/ClawHub-compatible)
- • Hosting behind a firewall with control over storage backends (local, S3/MinIO)
Not For
- • Public untrusted multi-tenant deployments without strong operational hardening (networking, secrets, backups, patching)
- • If you need hosted SaaS with turnkey SLA/support (it’s self-hosted)
- • If you need real-time/streaming APIs (no indication of websockets/streaming)
Interface
Authentication
README mentions OAuth identity merging and scoped API tokens for CLI/programmatic access, plus RBAC with audit logging. Local development uses mock-auth via X-Mock-User-Id header; production auth details beyond tokens/OAuth are not fully specified in the provided text.
Pricing
Self-hosted open-source; no pricing or hosted tiers described.
Agent Metadata
Known Gotchas
- ⚠ Local development uses mock auth via X-Mock-User-Id; agents should not assume this works in production.
- ⚠ Bootstrap admin exists by default in release template and local profile—agents should rotate/disable it before operating in real environments.
- ⚠ The README references OpenAPI contract sync and SDK regeneration; tooling drift can occur if clients/SDKs are not regenerated when contracts change.
Alternatives
Full Evaluation Report
Comprehensive deep-dive: security analysis, reliability audit, agent experience review, cost modeling, competitive positioning, and improvement roadmap for skillhub.
AI-powered analysis · PDF + markdown · Delivered within 30 minutes
Package Brief
Quick verdict, integration guide, cost projections, gotchas with workarounds, and alternatives comparison.
Delivered within 10 minutes
Score Monitoring
Get alerted when this package's AF, security, or reliability scores change significantly. Stay ahead of regressions.
Continuous monitoring
Scores are editorial opinions as of 2026-03-30.