Community hub bundle downloads are limited to verified publi

Error message

Community hub bundle downloads are limited to verified public items or private team items only. Please contact the system administrator to review or modify this setting. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills

What it means

Scope check inside communityHubDownloadsEnabled, run after the enable-check and after communityHubItem populated response.locals.bundleItem. It refuses with HTTP 422 when the hub item is NOT verified, is NOT private, and COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED is not exactly 'allow_all'. This is a deliberate security policy: unverified public bundles can run code on the instance, so they need an explicit opt-in.

Source

Thrown at server/utils/middleware/communityHubDownloadsEnabled.js:38

 * @returns {void}
 */
function communityHubDownloadsEnabled(request, response, next) {
  if (!("COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED" in process.env)) {
    return response.status(422).json({
      error:
        "Community Hub bundle downloads are not enabled. The system administrator must enable this feature manually to allow this instance to download these types of items. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills",
    });
  }

  // If the admin specifically did not set the system to `allow_all` then downloads are limited to verified items or private items only.
  // This is to prevent users from downloading unverified items and importing them into their own instance without understanding the risks.
  const item = response.locals.bundleItem;
  if (
    !item.verified &&
    item.visibility !== "private" &&
    process.env.COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED !== "allow_all"
  ) {
    return response.status(422).json({
      error:
        "Community hub bundle downloads are limited to verified public items or private team items only. Please contact the system administrator to review or modify this setting. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills",
    });
  }
  next();
}

/**
 * Fetch the bundle item from the community hub.
 * Sets `response.locals.bundleItem` and `response.locals.bundleUrl`.
 */
async function communityHubItem(request, response, next) {
  const { importId } = reqBody(request);
  if (!importId)
    return response.status(500).json({
      success: false,
      error: "Import ID is required",
    });

View on GitHub (pinned to 3aec848f28)

Solutions

Set COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=allow_all in .env — only if you accept the risk of importing unverified items that can execute code, then restart
Or import a hub item marked verified instead
Or import a private team item (visibility private always passes)
As an end user of a managed instance: contact the administrator — this is intentional policy, not a bug

Example fix

# before (.env)
COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=true   # unverified public item -> 422

# after (.env)
COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=allow_all  # explicit opt-in to unverified items

Defensive patterns

Strategy: validation

Validate before calling

const importable =
  item.verified || item.visibility === 'private' ||
  process.env.COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED === 'allow_all';
if (!importable) throw new Error('Item is unverified public and allow_all is not set');

Type guard

const isDownloadableItem = (item, env) =>
  Boolean(item?.verified) || item?.visibility === 'private' || env === 'allow_all';

Try / catch

if (res.status === 422) {
  const { error } = await res.json();
  if (/verified public items/.test(error)) pickVerifiedItemOrOptIn();
}

Prevention

Prefer verified or private hub items in production
Treat allow_all as a documented risk acceptance, not a default
Check the item's verified/visibility badges on the hub page before copying the importId

When it happens

Trigger: Downloading a Community Hub bundle that is public and unverified while COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED is true (or any value other than allow_all). Verified items and private team items pass; public unverified items do not.

Common situations: Admin enabled downloads with =true expecting all items to work, then tries a community-contributed (unverified) agent skill; users importing third-party prompt packs shared publicly on the hub.

Related errors

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/340cff50cb7b3e03. Report an issue: GitHub.