Summary

hermes skills list currently labels any non-hub-installed skill as builtin.

This is inaccurate for user-provided skills (for example skills synced from skills.sh into ~/.hermes/skills/), which are currently displayed as built-in even though they were not shipped with Hermes.

Why this matters

• Misleading provenance/trust signal in CLI output.
• Harder to debug where skills came from (bundled vs user/local vs hub).
• Confuses update ownership and support expectations.

Repro

1. Add a custom skill under ~/.hermes/skills/ that is not in Hermes bundled skills manifest and not installed via hub lockfile.
2. Run: hermes skills list
3. Observe skill appears as builtin.

Expected

hermes skills list should distinguish:

• hub (tracked in lockfile)
• builtin (present in bundled manifest)
• local (everything else under ~/.hermes/skills/)

Suggested implementation

Use tools.skills_sync._read_manifest() to detect true bundled skills by name during list rendering. Treat remaining non-hub skills as local.

Also expose --source local filter to support triage.