Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/apigee/devrel/skill-publishernpx skills add apigee/devrel --skill skill-publishergit clone --depth 1 https://github.com/apigee/devrelWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00112 | $0.03994 |
| Opus 5 | $0.00056 | $0.01997 |
| Sonnet 5 | $0.00022 | $0.00799 |
| Haiku 4.5 | $0.00011 | $0.00399 |
Grade A, and why
skill-publisher scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 315 lines — stays where its author put it; the contents beside it link to each section on GitHub.
skill-publisher
⚠️ Runtime requirements (read this first)
This skill requires its bundled venv wrapper. publish.sh
internally invokes the four scripts/* Python modules
(pack_skill, sign_skill, upload_skill, register_skill),
which depend on cryptography, google-auth, requests, and
pyyaml. Those are installed into a per-user venv by the
installer (bin/install-skill-publisher.sh). They are not
available to the system python3.
Always invoke publish.sh via the wrapper, never via bare
bash:
# CORRECT - the wrapper exports PYTHON to point at the venv:
${SKILL_DIR}/bin/run-with-venv.sh <args>
# WRONG - publish.sh will fall back to system python3 which
# will hit ModuleNotFoundError mid-pipeline:
bash ${SKILL_DIR}/scripts/publish.sh <args>
The Command blocks in this file use the wrapper form. Do not
"simplify" them — publish.sh reads $PYTHON from its
environment and the wrapper is the only thing that sets it
correctly. If you invoke publish.sh directly, the four
sub-scripts will fail with ModuleNotFoundError.
If the wrapper at ${SKILL_DIR}/bin/run-with-venv.sh is missing,
the skill was installed by a pre-v0.1.4 installer. Re-run
bin/install-skill-publisher.sh to regenerate the wrapper.
Use this skill when the user asks to "publish a skill", "ship this
skill to API hub", "upload and register my skill", "release the
skill", or any close paraphrase. This is the single entry point for
author-side distribution; it wraps the four scripts/* CLIs from
the upstream source repo into one orchestrated sequence with
fail-fast semantics.
What this skill does NOT do
- It does not create the GCS bucket. The bucket must already exist (see repo README §2).
- It does not create API hub attribute definitions. Run
python3 -m scripts.update_taxonomyonce per project first (see repo README §4). - It does not generate or rotate signing keys. The ed25519 private key path is an input.
- It does not install the published skill into any local
runtime. That is
skill-finder's job.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 315 lines · 112 tokens per session scan A ba4ab7116e85
skill-publisher is a skill published in the GitHub repository apigee/devrel (220 stars, last pushed 20d ago), licensed Apache-2.0. It adds 112 tokens to every session and 3,994 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-traffic-analytics
Route, install, and verify Apostl Pulse server-side analytics for public AI-agent traffic using the Cloudflare Worker or server SDK. Use when someone asks how many AI agents visit a website, docs, API, llms.txt, Markdown, or other public pages; wants per-page agent analytics; wants Pulse on Cloudflare, Express…
agent-native-experience
Audit, score, and improve agent-native product and documentation experience with evidence-backed quickstart execution, AFDocs-compatible checks, full-guide accounting, human-friction capture, RICE prioritization, and an optional Apostl-powered Journey Check. Use when someone asks to assess agent readiness, improve…
b00t-integration
Integration layer for b00t capabilities within opencode workflows. Provides access to b00t datum system, hive management, grok knowledge, session management, and task tracking directly from opencode.
model-routing
Select the right model for the task. Maps task cognitive tier to optimal model. Reads b00t datums for available models. Prefer local/cheap for deterministic work; frontier for reasoning.
b00t-rhai-bridge
Bridge b00t primitives (datum, grok, hive, task, agent) to opencode via RHAI scripts. RHAI provides the idiomatic abstraction layer connecting applications.
b00t-ooda
Run an autonomous OODA (Observe-Orient-Decide-Act) loop via ralph to execute task queues with a chosen AI executor. Use when asked to run autonomously, start an agent loop, execute pending tasks without supervision, or run OODA cycles. Activates on "run ooda", "autonomous loop", "start ralph", "execute tasks with…