Agent skills by board

One line: three boards, each with a named skill stack; 10 distinct stack skills installed across sol (all 10) and nova (4 of the same 10), 6 cards armed, and three of the five sources Young named do not apply to our stack or are blocked by the security scanner — reasons below, measured not assumed.

This file is the standing catalogue. It carries no date in its name on purpose: update it in place, do not fork a second one.

1. The mechanism — how a card gets a skill (read from source, not docs)

Consequence, and it is the expensive one: arming a card with a wrong name looks identical to arming it correctly. A green card is not proof. Verify from the worker's own log:

┊ 📚 skill     db-migrate  0.1s

That line is the only evidence a skill actually loaded. It was confirmed today on a card armed with building-with-medusa + db-migrate.

2. Board → skill stack

Skills are assigned per task, because the same agent does different work on different boards.

Docker vHost — build the tenancy platform

Medusa backend, Nuxt storefront, Medusa Admin customisations, per-tenant email providers.

Research — evidence and verification

No new dependency skills needed. The existing set already covers this board: grounded-citations, live-system-verification, probe-integrity, external-repo-study, blocked-page-recovery, codebase-inspection, hh/deep-dive (echo).

Daily Operation — fleet, boards, cost, models

Existing set already covers it: hermes-kanban-board, agent-fleet-operations, solos2-fleet-ops, multi-agent-fleet-operations, truthful-status-fields, live-system-verification, systemd-python-services, model-cost-and-tier-policy (mira).

3. Installed inventory — measured 2026-10-21

10 distinct stack skills, not 10 per profile. nova's four are a subset of sol's ten — counting installs per profile would double-count them.

sol carries the full vHost stack because sol owns the build lane. nova carries the design subset because she owns the docs/storefront design work. Do not install the Medusa stack into a profile that does not build — a skill nobody uses is context cost on every session.

Exact install commands (reproducible)

# sol — full vHost build stack
for s in building-with-medusa building-storefronts building-admin-dashboard-customizations \
         storefront-best-practices db-migrate db-generate; do
  hermes -p sol skills install skills-sh/medusajs/medusa-agent-skills/$s --yes
done
for s in vercel-react-best-practices vercel-composition-patterns web-design-guidelines; do
  hermes -p sol skills install skills-sh/vercel-labs/agent-skills/$s --yes
done
hermes -p sol skills install skills-sh/nuxt/ui/nuxt-ui --force --yes   # see §5 for the reason

# nova — design subset
for s in building-storefronts web-design-guidelines vercel-react-best-practices; do
  hermes -p nova skills install $([ "${s:0:6}" = "vercel" ] \
      && echo skills-sh/vercel-labs/agent-skills/$s || echo skills-sh/medusajs/medusa-agent-skills/$s) --yes
done
hermes -p nova skills install skills-sh/nuxt/ui/nuxt-ui --force --yes

# creative trio — already-filed fleet-parity item, now done for all five profiles
for p in min mira sol echo nova; do
  for s in creative-ideation excalidraw hyperframes; do
    hermes -p $p skills install official/creative/$s --yes
  done
done

4. Cards armed today

5. Blocked, moved, or not applicable — with the reason

These are the three findings that matter more than the installs, because they stop someone repeating work that cannot succeed.

① vercel-labs/next-skills — the repo MOVED, and Next.js is not in our stack. The repo's own README says the skills now live in vercel/next.js/tree/canary/skills, so the URL Young supplied is a tombstone. More importantly, we do not run Next.js: the tenant storefront is Nuxt 3 + @nuxt/ui 2.18 (/home/ubuntu/builds/storefront/package.json on prod), and Medusa Admin is a React SPA shipped inside the medusa image. Installing Next cache-component skills would arm workers with guidance for a framework no service in this platform uses. → Not installed, deliberately. Revisit only if a tenant service is actually built on Next.

② nuxt-ui — scanner verdict CAUTION, forced after reading every flagged line. Two HIGH "traversal" findings both point at references/guidelines/conventions.md:39, which is a Tailwind v4 @source "../../../content/**/*"; directive inside a CSS code block. Static text, nothing executable. → Installed with --force; verdict recorded here so the next auditor does not have to re-derive it.

③ building-with-medusa — scanner verdict CAUTION (13 findings), forced after reading them. Every finding is a relative import inside a documentation code sample (import { deleteReviewWorkflow } from "../../../../workflows/delete-review") or a ❌ No double negation (!!) style rule in a do-not-do list. The skill is prose + reference markdown; it carries no script. One finding is a "❌ No double …" line in reference/workflows.md:153 — a style prohibition, matched as "execution". → Installed with --force.

④ learning-medusa — BLOCKED, 29 findings, not installed. Includes sudo systemctl … lines in troubleshooting/common-errors.md. It is a tutorial skill and we do not need it for builds, so the honest call is to leave it blocked rather than force a skill whose content tells a worker to run sudo systemctl.

⑤ creating-agents-in-medusa — registry download failed on two attempts (Error: Could not download). Not a verdict, a transient/registry fault. Retry before concluding. It matters for EVE, so it should be picked up when the EVE lane next touches agent building.

⑥ using-medusa-cloud + five mcloud-* skills — not applicable. We self-host Medusa on our own prod host. These manage Medusa Cloud resources through mcloud. → Not installed. Revisit only if the platform moves to Medusa Cloud.

6. How an agent chooses and adds its own skills

The catalogue is not a gate — it is the map. Any agent may extend its own set:

hermes skills search <query>            # what exists
hermes skills inspect <identifier>      # read it before installing
hermes -p <profile> skills install <identifier> --yes

Two rules for the agent doing it:

1. Read the security verdict before forcing. A CAUTION/BLOCKED verdict must be resolved by reading the flagged lines, and the verdict + reason written down here. Never --force to make an install go green.
2. Install into the profile that does the work. Installing the Medusa stack into mira costs context on every finance session and buys nothing.

To arm a task, the skill list must be passed at creation — there is no setter afterwards:

hermes kanban --board docker-vhost create "<title>" --assignee sol \
  --skill building-with-medusa --skill db-migrate --body-file <file>

7. What is still owed

• creating-agents-in-medusa — retry the install (registry fault, not a verdict).
• learning-medusa — decide to drop it from the requested set, or accept it blocked.
• No vHost card is yet armed with building-admin-dashboard-customizations or db-generate; arm them when an admin-UI or schema-change card is next created.
• next.js — no action. Recorded as not-applicable so nobody installs it by mistake.