{"record":{"id":"d95b5fce146cc9c6","repo":"Mintplex-Labs/anything-llm","slug":"community-hub-bundle-downloads-are-not-enabled-th","errorCode":null,"errorMessage":"Community Hub bundle downloads are not enabled. The system administrator must enable this feature manually to allow this instance to download these types of items. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills","messagePattern":"Community Hub bundle downloads are not enabled\\. The system administrator must enable this feature manually to allow this instance to download these types of items\\. See https://docs\\.anythingllm\\.com/configuration#anythingllm-hub-agent-skills","errorType":"http","errorClass":null,"httpStatus":422,"severity":"warning","filePath":"server/utils/middleware/communityHubDownloadsEnabled.js","lineNumber":24,"sourceCode":" * Checks if community hub bundle downloads are enabled. The reason this functionality is disabled\n * by default is that since AgentSkills, Workspaces, and DataConnectors are all imported from the\n * community hub via unzipping a bundle - it would be possible for a malicious user to craft and\n * download a malicious bundle and import it into their own hosted instance. To avoid this, this\n * functionality is disabled by default and must be enabled manually by the system administrator.\n *\n * On hosted systems, this would not be an issue since the user cannot modify this setting, but those\n * who self-host can still unlock this feature manually by setting the environment variable\n * which would require someone who likely has the capacity to understand the risks and the\n * implications of importing unverified items that can run code on their system, container, or instance.\n * @see {@link https://docs.anythingllm.com/docs/community-hub/import}\n * @param {import(\"express\").Request} request\n * @param {import(\"express\").Response} response\n * @param {import(\"express\").NextFunction} next\n * @returns {void}\n */\nfunction communityHubDownloadsEnabled(request, response, next) {\n  if (!(\"COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED\" in process.env)) {\n    return response.status(422).json({\n      error:\n        \"Community Hub bundle downloads are not enabled. The system administrator must enable this feature manually to allow this instance to download these types of items. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills\",\n    });\n  }\n\n  // If the admin specifically did not set the system to `allow_all` then downloads are limited to verified items or private items only.\n  // This is to prevent users from downloading unverified items and importing them into their own instance without understanding the risks.\n  const item = response.locals.bundleItem;\n  if (\n    !item.verified &&\n    item.visibility !== \"private\" &&\n    process.env.COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED !== \"allow_all\"\n  ) {\n    return response.status(422).json({\n      error:\n        \"Community hub bundle downloads are limited to verified public items or private team items only. Please contact the system administrator to review or modify this setting. See https://docs.anythingllm.com/configuration#anythingllm-hub-agent-skills\",\n    });\n  }","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/utils/middleware/communityHubDownloadsEnabled.js#L6-L42","documentation":"Gate middleware for Community Hub bundle downloads. If the COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED environment variable is not present at all, the request is refused with HTTP 422 and a message pointing at the docs. The check is presence-based: any value enables downloads of verified/private items; only the exact value 'allow_all' additionally permits unverified public items.","triggerScenarios":"Calling a community-hub import/download route (behind the communityHubDownloadsEnabled middleware) on an instance where COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED is absent from the environment.","commonSituations":"Fresh self-hosted install where the flag was never set; .env edited but container not recreated so the old environment persists; hosted default posture that intentionally ships without the flag.","solutions":["Add COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=true (verified/private items only) or =allow_all (all items) to .env as described in the linked docs","Restart the server / recreate the container so the variable is loaded","Confirm with printenv | grep COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED inside the container"],"exampleFix":"# before (.env)\n# (variable absent) -> 422 on every hub download\n\n# after (.env)\nCOMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED=true","handlingStrategy":"validation","validationCode":"// deployment check before enabling hub import features\nconst has = \"COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED\" in process.env;\nif (!has) throw new Error('Hub downloads will 422: set COMMUNITY_HUB_BUNDLE_DOWNLOADS_ENABLED');","typeGuard":null,"tryCatchPattern":"if (res.status === 422) {\n  const { error } = await res.json();\n  if (/not enabled/.test(error)) instructAdminToSetEnvFlag();\n}","preventionTips":["Add the flag to the instance's .env template when hub imports are planned","Bake the variable into the deployment manifest, not ad-hoc docker exec","Verify env presence inside the container after deploy"],"tags":["environment-variable","community-hub","anythingllm","http-422","feature-flag"],"backgroundTag":"missing-env-var","analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}