Skill Packs
Group built-in skills by domain and install security-scanned community skill packs from third-party repositories.
Skill packs keep your dashboard focused on the domains you actually run. First-party packs act as a visibility lens over built-in skills, while community packs install third-party skill bundles after an automated security scan.
First-Party Packs
Every instance ships all built-in skills, showing Core, Evolution, and Basics by default and grouping the rest into domain packs. Enabling a first-party pack reveals its skills in the UI (each skill still has its own enabled toggle):
| Pack | Default Visibility | Focus |
|---|---|---|
| Core | Always on | Fleet coordination, self-configuration, liveness, and memory. |
| Evolution | Shown by default | Self-improvement loop that authors, evaluates, and repairs skills. |
| Basics | Shown by default | Daily digests, articles, X posts, and web research starters. |
| Dev & Code | Opt-in pack | PR/issue triage, code review, deploys, security scanning, and cost audits. |
| Crypto & Markets | Opt-in pack | Token, DeFi, and prediction-market monitoring plus on-chain forensics. |
| Productivity | Opt-in pack | Routines, idea pipelines, competitor tracking, email, and media generation. |
The pack registry is generated by bin/generate-packs-json (see docs/skill-packs.md).
Community Packs
Third-party skill collections live in their own GitHub repositories and can be installed with one click from the dashboard's Packs tab or via the CLI:
bin/install-skill-pack --list # browse catalog/skill-packs.json
bin/install-skill-pack clawhunter/clawhunter-skills # scan and install a packBrowse the live registry at catalog/skill-packs.json and the specification at docs/community-skill-packs.md.
Trust Model
Manifest discovery
Reads skills-pack.json (or scans skills/) in the target repository to list candidate SKILL.md files.
Automated security scan
skill-scan checks every prompt for arbitrary code execution, secret exfiltration, destructive shell commands, prompt injection, and credential-path access.
Disabled-by-default install
Installed skills land in aeon.yml with enabled: false until you explicitly activate them.
Lockfile provenance
Records the source repository, branch, and commit SHA in skills.lock for reproducible updates.