Vellum Skills Catalog

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/skills/vellum-skills-catalogThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Discover bundled skills and search/install community skills from the skills.sh registry

---
name: vellum-skills-catalog
description: Discover bundled skills and search/install community skills from the skills.sh registry
compatibility: "Designed for Vellum personal assistants"
metadata:
  emoji: "🧩"
  vellum:
    category: "system"
    display-name: "Skills Catalog"
    activation-hints:
      - "what can you do"
      - "find a skill"
      - "install a skill"
      - "community skills"
      - "skills.sh"
      - "search for skills"
    avoid-when:
      - "User is asking about a specific bundled skill already visible in the catalog"
---

You can help the user discover what skills are available and find community skills to extend the assistant's capabilities.

## Bundled skills (first-party)

First-party skills are **bundled** with the assistant - they are compiled in and always available. They do not need to be installed or downloaded. To activate a bundled skill, use the `skill_load` tool:

```
skill_load skill=<skill-id>
```

The skill catalog shown in the system prompt lists all bundled skills with their IDs. When a user asks about capabilities, refer to this list to find relevant bundled skills and load them as needed.

## Community skills (skills.sh)

Community skills are published on the skills.sh registry and can be searched, inspected, and installed on demand using the `assistant skills` CLI.

### Searching for community skills

```bash
assistant skills search "<query>"
```

Returns matching skills with their slug, source, install counts, and security audit badges. Use this when the user asks for a capability not covered by bundled skills.

### Installing a community skill

**Trust model - check the source guardian before installing:**

- **Vellum-owned** (`vellum-ai/*`): First-party skills published by the Vellum team. Install these directly without prompting - they are vetted and trusted.
- **Third-party** (any other guardian): Ask the user for permission first. Present the skill name, source, audit results, and install count. Say something like: "I found a community skill that could help, but it's published by a third party - we haven't vetted it. Want to install it anyway?"

```bash
assistant skills add <owner>/<repo>@<skill-name>
```

For example:

```bash
assistant skills add vercel-labs/skills@find-skills
```

Once installed, the skill appears in the workspace skills directory and can be loaded with `skill_load` like any other skill.

## Typical flow

1. **User asks about capabilities** - "Can you order food?" or "What can you do?"
   - Check the bundled skills list in the system prompt
   - Present relevant skills to the user
   - Load any that match with `skill_load`

2. **User wants a capability not covered by bundled skills** - "Can you do X?"
   - Search with `assistant skills search "<query>"`
   - Present matching results with descriptions, install counts, and audit badges
   - Check the source guardian to determine trust level (see trust model above)
   - Install with `assistant skills add <owner>/<repo>@<skill-name>`
   - Load it with `skill_load`

3. **Skill has dependencies** - if `includes` lists other skill IDs, load those first with `skill_load`

## Notes

- Bundled skills are always available and do not need installation
- Community skills are installed to the workspace skills directory
- After installing a community skill, it is auto-enabled and immediately loadable
- Skills can be enabled or disabled via feature flags without uninstalling them
- Never install third-party community skills without explicit user confirmation

Excerpt, first 3,535 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/vellum-ai/vellum-assistant
git -C vellum-assistant checkout 19bc86343b63

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 19bc86343b63

Questions about Vellum Skills Catalog

• github.com/vellum-ai/vellum-assistant/tree/main/skills/vellum-sk — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology