Community Hub bundle downloads are not enabled. The system…

Error message

Community Hub bundle downloads are not enabled. The system administrator must enable this feature manually to allow this instance to download these types of items. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills

What it means

Gate middleware for Community Hub bundle downloads. If the COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED environment variable is not present at all, the request is refused with HTTP 422 and a message pointing at the docs. The check is presence-based: any value enables downloads of verified/private items; only the exact value 'allow_all' additionally permits unverified public items.

Solutions

Add COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=true (verified/private items only) or =allow_all (all items) to .env as described in the linked docs
Restart the server / recreate the container so the variable is loaded
Confirm with printenv | grep COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED inside the container

Example fix

# before (.env)
# (variable absent) -> 422 on every hub download

# after (.env)
COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=true

Defensive patterns

Strategy: validation

Validate before calling

// deployment check before enabling hub import features
const has = "COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED" in process.env;
if (!has) throw new Error('Hub downloads will 422: set COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED');

Try / catch

if (res.status === 422) {
  const { error } = await res.json();
  if (/not enabled/.test(error)) instructAdminToSetEnvFlag();
}

Prevention

Add the flag to the instance's .env template when hub imports are planned
Bake the variable into the deployment manifest, not ad-hoc docker exec
Verify env presence inside the container after deploy

When it happens

Trigger: Calling a community-hub import/download route (behind the communityHubDownloadsEnabled middleware) on an instance where COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED is absent from the environment.

Common situations: Fresh self-hosted install where the flag was never set; .env edited but container not recreated so the old environment persists; hosted default posture that intentionally ships without the flag.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/d95b5fce146cc9c6. Report an issue: GitHub.

Appendix: source

Thrown at server/utils/middleware/communityHubDownloadsEnabled.js:24

 * Checks if community hub bundle downloads are enabled. The reason this functionality is disabled
 * by default is that since AgentSkills, Workspaces, and DataConnectors are all imported from the
 * community hub via unzipping a bundle - it would be possible for a malicious user to craft and
 * download a malicious bundle and import it into their own hosted instance. To avoid this, this
 * functionality is disabled by default and must be enabled manually by the system administrator.
 *
 * On hosted systems, this would not be an issue since the user cannot modify this setting, but those
 * who self-host can still unlock this feature manually by setting the environment variable
 * which would require someone who likely has the capacity to understand the risks and the
 * implications of importing unverified items that can run code on their system, container, or instance.
 * @see {@link https://docs.anythingllm.com/docs/community-hub/import}
 * @param {import("express").Request} request
 * @param {import("express").Response} response
 * @param {import("express").NextFunction} next
 * @returns {void}
 */
function communityHubDownloadsEnabled(request, response, next) {
  if (!("COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED" in process.env)) {
    return response.status(422).json({
      error:
        "Community Hub bundle downloads are not enabled. The system administrator must enable this feature manually to allow this instance to download these types of items. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills",
    });
  }

  // If the admin specifically did not set the system to `allow_all` then downloads are limited to verified items or private items only.
  // This is to prevent users from downloading unverified items and importing them into their own instance without understanding the risks.
  const item = response.locals.bundleItem;
  if (
    !item.verified &&
    item.visibility !== "private" &&
    process.env.COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED !== "allow_all"
  ) {
    return response.status(422).json({
      error:
        "Community hub bundle downloads are limited to verified public items or private team items only. Please contact the system administrator to review or modify this setting. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills",
    });
  }

View on GitHub (pinned to 3aec848f28)