{"record":{"id":"340cff50cb7b3e03","repo":"Mintplex-Labs/anything-llm","slug":"community-hub-bundle-downloads-are-limited-to-veri","errorCode":null,"errorMessage":"Community hub bundle downloads are limited to verified public items or private team items only. Please contact the system administrator to review or modify this setting. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills","messagePattern":"Community hub bundle downloads are limited to verified public items or private team items only\\. Please contact the system administrator to review or modify this setting\\. See https://docs\\.anythingllm\\.com/configuration#anythingllm-hub-agent-skills","errorType":"http","errorClass":null,"httpStatus":422,"severity":"warning","filePath":"server/utils/middleware/communityHubDownloadsEnabled.js","lineNumber":38,"sourceCode":" * @returns {void}\n */\nfunction communityHubDownloadsEnabled(request, response, next) {\n  if (!(\"COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED\" in process.env)) {\n    return response.status(422).json({\n      error:\n        \"Community Hub bundle downloads are not enabled. The system administrator must enable this feature manually to allow this instance to download these types of items. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills\",\n    });\n  }\n\n  // If the admin specifically did not set the system to `allow_all` then downloads are limited to verified items or private items only.\n  // This is to prevent users from downloading unverified items and importing them into their own instance without understanding the risks.\n  const item = response.locals.bundleItem;\n  if (\n    !item.verified &&\n    item.visibility !== \"private\" &&\n    process.env.COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED !== \"allow_all\"\n  ) {\n    return response.status(422).json({\n      error:\n        \"Community hub bundle downloads are limited to verified public items or private team items only. Please contact the system administrator to review or modify this setting. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills\",\n    });\n  }\n  next();\n}\n\n/**\n * Fetch the bundle item from the community hub.\n * Sets `response.locals.bundleItem` and `response.locals.bundleUrl`.\n */\nasync function communityHubItem(request, response, next) {\n  const { importId } = reqBody(request);\n  if (!importId)\n    return response.status(500).json({\n      success: false,\n      error: \"Import ID is required\",\n    });","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/utils/middleware/communityHubDownloadsEnabled.js#L20-L56","documentation":"Scope check inside communityHubDownloadsEnabled, run after the enable-check and after communityHubItem populated response.locals.bundleItem. It refuses with HTTP 422 when the hub item is NOT verified, is NOT private, and COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED is not exactly 'allow_all'. This is a deliberate security policy: unverified public bundles can run code on the instance, so they need an explicit opt-in.","triggerScenarios":"Downloading a Community Hub bundle that is public and unverified while COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED is true (or any value other than allow_all). Verified items and private team items pass; public unverified items do not.","commonSituations":"Admin enabled downloads with =true expecting all items to work, then tries a community-contributed (unverified) agent skill; users importing third-party prompt packs shared publicly on the hub.","solutions":["Set COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=allow_all in .env — only if you accept the risk of importing unverified items that can execute code, then restart","Or import a hub item marked verified instead","Or import a private team item (visibility private always passes)","As an end user of a managed instance: contact the administrator — this is intentional policy, not a bug"],"exampleFix":"# before (.env)\nCOMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=true   # unverified public item -> 422\n\n# after (.env)\nCOMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=allow_all  # explicit opt-in to unverified items","handlingStrategy":"validation","validationCode":"const importable =\n  item.verified || item.visibility === 'private' ||\n  process.env.COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED === 'allow_all';\nif (!importable) throw new Error('Item is unverified public and allow_all is not set');","typeGuard":"const isDownloadableItem = (item, env) =>\n  Boolean(item?.verified) || item?.visibility === 'private' || env === 'allow_all';","tryCatchPattern":"if (res.status === 422) {\n  const { error } = await res.json();\n  if (/verified public items/.test(error)) pickVerifiedItemOrOptIn();\n}","preventionTips":["Prefer verified or private hub items in production","Treat allow_all as a documented risk acceptance, not a default","Check the item's verified/visibility badges on the hub page before copying the importId"],"tags":["community-hub","security-policy","anythingllm","http-422","feature-flag"],"backgroundTag":"unverified-content-blocked","analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}