<p align="center"> <img src="assets/avatar.png" alt="Muse" width="180"> </p>

Muse Skill Hub

An open, LLM-agnostic capability runtime for AI agents. Define capabilities once. Discover them dynamically. Execute them through typed tools. Enforce permissions at runtime. Keep failures honest. Created by Wahyu Nur Iman.

⚡ Executable Runtime

<!-- METRICS:START -->

Generated from registry + test suite — do not hand-edit. Run python tools/sync_readme.py.

Version 2.3.0 · 97 skills · 96 executable drivers (1 honest stubs) · 222 MCP tools · 313 passing tests

<!-- METRICS:END -->

Evidence honesty: of the 96 executable drivers, 2 are live-tested against real provider servers (github, podcast), 3 have mock-contract tests (stripe, lovable, replit), and 91 are structural (real code, provider handshake is the operator's step). Full per-driver matrix: certification/PROVIDER_MATRIX.md (generated — do not hand-edit).

This repo is no longer just a catalog — it ships a real MCP server exposing every action as its own typed tool (e.g. github_search_repositories, with full JSON schemas — no opaque params blob). Skills are backed by real, executable drivers; a few remain honest catalog-only stubs (structured driver_not_implemented — never fake data):

cd runtime && pip install -r requirements.txt && python -m skillhub.server

• 94 real drivers across three kinds:
  • Third-party APIs (62): github, slack, stripe, shopify, linear, vercel, asana, notion, todoist, places-search, zoom, gmail, google-calendar, google-sheets, google-drive, spotify, instagram, meta-threads, threads, facebook, dropbox, ticketmaster, image-search, flightaware, box, calendly, canva, duffel, figma, ghl, klaviyo, meta-ads, plaid (sandbox), printify, quickbooks, tts, voice-design, voice-selector, voice-calls, zapier, outlook-calendar, outlook-mail, outlook-contacts, google-contacts, google-docs, google-forms, google-slides, google-tasks, messenger, instagram-messages, threads-messages, withings, tailscale, tessie, peloton, philips-hue, podcast, shopping, wide-research, social-content-performance, evernote, healthex (MCP passthrough), granola, generate_podcast (needs ElevenLabs key for TTS)
  • Local reference implementations (32): secure-vault (encrypted), permission-model, personal-feed, idea-management, goals, share-ideas, agent-library, connector-management, paired-devices, data-control, messaging-channels, wallet, apple-healthkit + google-health-connect (local export readers), device-data, media-library, forget, self-awareness, skill-creator, function-health, travel-planning, muse_db (SQLite), muse-feedback, subscription-status, wearable-device-skills, wearables-comms, booking (router), opentable (deep links), facebook-cli (passthrough), magic-moment (local ffmpeg)
  • Catalog-only stubs (3): lovable, muse-early-access, replit — no public API exists (or it is an internal-only program); documented honestly instead of faked, with workarounds where one exists
• MCP tools (per-action, fully typed) + skillhub_search_capabilities for dynamic capability discovery (counts in the metrics block above)
• Approval engine — write actions need approval; sensitive/destructive/communication/financial/account/device risks require a real approval_id (bound to exact skill/action/params, single-use, 10-min TTL). Bare confirm=true only suffices for plain write risk
• Policy engine — risk-based allow/approval_required/deny with per-action classification and custom policy files
• Audit log — every execution recorded (request_id, actor, risk, params hash, approval_id, duration); secrets never logged raw; query via function-health query_audit_log
• Idempotency — idempotency_key on write actions: repeats return the first result instead of re-executing
• Credential manager — env → local file → encrypted vault; ref:vault:<name> references resolve server-side so secret values never reach the LLM
• Hardened HTTP layer — persistent connection pooling, retry with exponential backoff + Retry-After, X-Request-ID correlation, structured 429/5xx mapping
• Skill manifests — runtime/skillhub/catalog/<name>/manifest.yaml is the machine-readable contract; skillhub validate runs the conformance test (schemas, risk, auth, manifest/driver/SKILL.md drift, secret scan)
• Passing tests (count in the metrics block above), including live api.github.com calls, an end-to-end MCP stdio session with per-action tools, approval-lifecycle/idempotency/audit/security tests, and credential-error coverage for every API driver

What's new in v2.2.0 (concurrency + crash hardening)

• Cross-platform file locking — new skillhub.filelock module (fcntl on Unix, msvcrt on Windows); no more top-level import fcntl, so the runtime imports cleanly on Windows
• Crash-atomic stores — every read-modify-write cycle (locked_json, credential store) now holds a separate <name>.lock file and writes back via tmp + fsync + os.replace: atomic against concurrency and crashes
• OAuth single-flight refresh — the check → refresh → persist cycle runs under the store lock with double-checked expiry; 20 concurrent workers on an expired token produce exactly 1 refresh request
• Fail-closed credential store — a corrupt/undecryptable credentials.enc raises CredentialStoreCorruptError (with a .corrupt backup) instead of silently looking like "no credentials"
• Approval privacy — the approval store no longer persists raw params; only params_hash + a redacted preview. Execution re-supplies params and consume() verifies them against the hash
• Real JSON Schema — validation now runs on the standard jsonschema library (Draft 2020-12, full vocabulary: $ref, if/then/else, dependentRequired, …) with format checking; skillhub validate lints every action schema
• Declared dependencies — cryptography and jsonschema are now official dependencies (they were already required at runtime)
• Generated README metrics — runtime/tools/sync_readme.py regenerates the metrics block from the registry + test suite; a test fails if the README drifts
• Multi-process race tests — approval consumption and idempotency reservation are now proven with 20 processes (not just threads), matching the documented guarantee

What's new in v2.1.0 (security hardening)

• Atomic approval consumption — approval approve/consume transitions happen inside a locked critical section, so concurrent workers can't double-spend one approval (proven by a 20-thread race test)
• Atomic idempotency — PENDING → SUCCEEDED | FAILED → CONFLICT reservation happens before side effects; concurrent duplicates see pending and never re-execute; failed records allow exactly one reclaim
• Honest naming — idempotent renamed to supports_idempotency_key: the runtime supports dedup keys, it does not claim mathematical idempotence of the underlying API
• Output contracts — handler results are validated against each action's output_schema before success is committed; violations never get cached
• Real JSON-Schema validation (v2.2.0: standard jsonschema library, Draft 2020-12) — strict by default (unknown params rejected, like MCP's additionalProperties: false)
• Credential scopes — actions declare required_scopes (Gmail/Outlook/Google Workspace drivers); mismatches are blocked, unknown scopes are allowed but marked unverified in audit
• Encrypted credential store — local credentials now live in an encrypted credentials.enc (Fernet, secure-vault key); the old plaintext fallback is gone, legacy files are migrated and deleted
• OAuth refresh manager — encrypted access/refresh tokens with auto-refresh before expiry and rotation persistence
• Audit hash chain — every event carries prev_hash/event_hash; python -m skillhub.cli audit-verify detects tampering (tamper-evident, not tamper-proof)
• TF-IDF capability discovery — skillhub_search_capabilities now ranks by lexical relevance instead of substring matching
• Provider mock harness — SKILLHUB_MOCK=1 routes api_request to canned responders; mock contract tests for GitHub and Stripe assert request shapes and auth flow without network
• SQL hardening — muse_db strips comments/strings before keyword scanning, runs reads on a read-only SQLite connection, and enforces single statements
• Zero doc warnings — all 178 missing action docs generated; skillhub validate passes clean
• Passing tests (count in the metrics block above; was 67 in v1.5.0), including 20-thread concurrency races, scope mismatches, encrypted-store migration, OAuth refresh, audit tampering, and provider contracts

Security model (honest): this is a trusted, local, single-user MCP runtime. Encryption protects against casual disk exposure, not against malware or same-user attackers. actor is a local session label, not authentication. Multi-user tenant isolation, distributed exactly-once, and workflow/saga engines remain out of scope (see specs/).

See runtime/README.md for setup, driver docs, and how to add your own driver. Specs live in specs/ (manifest, error contract, approval protocol).

---

About this repo

This repo contains a catalog of all of Muse's skills/capabilities (Muse is Meta's personal AI agent). The goal is an open reference: what Muse can do, what the patterns are, and inspiration for building similar capabilities in other AIs/LLMs.

Important note: This file only contains high-level lists and descriptions, not raw internal files. Muse's real skills run on a specialized runtime (MCP servers, OAuth, custom CLIs, etc.), so just reading this list won't automatically make another AI 99.9% like Muse — but it can be a very useful blueprint.

Total documented skills: 97

🌐 Flagship Capability: The Live Browser

Of the 97 skills cataloged below, the single strongest one is not in the table — it is the live browser: a real Chromium that Muse drives directly. It opens pages, reads, clicks, types, searches, uploads files, and completes multi-step flows on the open web, with the user's approvals gating sensitive actions.

API skills cover known integrations. The browser covers everything else — the entire web becomes the API. In practice:

• Read anything live — prices, availability, account state, and content behind JavaScript-heavy pages that no API exposes, with sources attached.
• Act on the web — fill forms, sign in, upload files, walk multi-step flows. Checkouts pause for explicit approval; nothing sensitive completes silently.
• Operate end-to-end — run a YouTube creator pipeline (upload via YouTube Studio, fill titles/descriptions/tags, set audience, publish, verify), search and track job applications, register for services, monitor changes.

Honest limits (this repo keeps failures honest): logins and sensitive actions need the user's approval; CAPTCHAs and bot checks pause for the user; some sites block automation outright; a failed page load is reported as a failure, never papered over with guessed content.

The catalog below is the integration layer. The browser is the universal layer — the reason a Muse-style agent can do work no fixed skill list anticipates.

Universal Skills (Usable by Any LLM) 🌐

Each skill now has two files:

• runtime/skillhub/catalog/<name>/README.md — Human-readable documentation (what it does, when to use)
• `runtime/skillhu