skill-publisher

A publishing workflow for putting a local coding-agent skill into an API catalogue and bundle store. It packages the skill, signs its manifest, uploads the bundle, and registers it.

In plain words
What is it for?
Use it to publish a skill directory, create its deterministic signed archive, upload it, and register its metadata.
Why use it?
It automates the multi-step release process and uses the required environment for its Python dependencies.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/apigee/devrel/skill-publisher
Any agent
npx skills add apigee/devrel --skill skill-publisher
Clone the repo
git clone --depth 1 https://github.com/apigee/devrel

Made for: Claude Code, Codex.

Per session 112 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,994 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00112 $0.03994
Opus 5 $0.00056 $0.01997
Sonnet 5 $0.00022 $0.00799
Haiku 4.5 $0.00011 $0.00399

Measured 2d ago against content hash ba4ab7116e85, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

skill-publisher scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/publish.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

references/apigee-skills-serving/skills/skill-publisher/SKILL.md · 315 lines

How it starts

The opening of the file, as written. The whole thing — 315 lines — stays where its author put it; the contents beside it link to each section on GitHub.

skill-publisher

⚠️ Runtime requirements (read this first)

This skill requires its bundled venv wrapper. publish.sh internally invokes the four scripts/* Python modules (pack_skill, sign_skill, upload_skill, register_skill), which depend on cryptography, google-auth, requests, and pyyaml. Those are installed into a per-user venv by the installer (bin/install-skill-publisher.sh). They are not available to the system python3.

Always invoke publish.sh via the wrapper, never via bare bash:

# CORRECT - the wrapper exports PYTHON to point at the venv:
${SKILL_DIR}/bin/run-with-venv.sh <args>

# WRONG - publish.sh will fall back to system python3 which
# will hit ModuleNotFoundError mid-pipeline:
bash ${SKILL_DIR}/scripts/publish.sh <args>

The Command blocks in this file use the wrapper form. Do not "simplify" them — publish.sh reads $PYTHON from its environment and the wrapper is the only thing that sets it correctly. If you invoke publish.sh directly, the four sub-scripts will fail with ModuleNotFoundError.

If the wrapper at ${SKILL_DIR}/bin/run-with-venv.sh is missing, the skill was installed by a pre-v0.1.4 installer. Re-run bin/install-skill-publisher.sh to regenerate the wrapper.


Use this skill when the user asks to "publish a skill", "ship this skill to API hub", "upload and register my skill", "release the skill", or any close paraphrase. This is the single entry point for author-side distribution; it wraps the four scripts/* CLIs from the upstream source repo into one orchestrated sequence with fail-fast semantics.

What this skill does NOT do

  • It does not create the GCS bucket. The bucket must already exist (see repo README §2).
  • It does not create API hub attribute definitions. Run python3 -m scripts.update_taxonomy once per project first (see repo README §4).
  • It does not generate or rotate signing keys. The ed25519 private key path is an input.
  • It does not install the published skill into any local runtime. That is skill-finder's job.

Read the full file on GitHub · 315 lines

Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 315 lines · 112 tokens per session scan A ba4ab7116e85

Subscribe to this mod's changes

skill-publisher is a skill published in the GitHub repository apigee/devrel (220 stars, last pushed 20d ago), licensed Apache-2.0. It adds 112 tokens to every session and 3,994 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

agent-traffic-analytics

Route, install, and verify Apostl Pulse server-side analytics for public AI-agent traffic using the Cloudflare Worker or server SDK. Use when someone asks how many AI agents visit a website, docs, API, llms.txt, Markdown, or other public pages; wants per-page agent analytics; wants Pulse on Cloudflare, Express…

apostl-dev/apostl-skills · 102 tokens

agent-native-experience

Audit, score, and improve agent-native product and documentation experience with evidence-backed quickstart execution, AFDocs-compatible checks, full-guide accounting, human-friction capture, RICE prioritization, and an optional Apostl-powered Journey Check. Use when someone asks to assess agent readiness, improve…

apostl-dev/apostl-skills · 119 tokens

b00t-integration

Integration layer for b00t capabilities within opencode workflows. Provides access to b00t datum system, hive management, grok knowledge, session management, and task tracking directly from opencode.

elasticdotventures/_b00t_ · 45 tokens

model-routing

Select the right model for the task. Maps task cognitive tier to optimal model. Reads b00t datums for available models. Prefer local/cheap for deterministic work; frontier for reasoning.

elasticdotventures/_b00t_ · 43 tokens

b00t-rhai-bridge

Bridge b00t primitives (datum, grok, hive, task, agent) to opencode via RHAI scripts. RHAI provides the idiomatic abstraction layer connecting applications.

elasticdotventures/_b00t_ · 46 tokens

b00t-ooda

Run an autonomous OODA (Observe-Orient-Decide-Act) loop via ralph to execute task queues with a chosen AI executor. Use when asked to run autonomously, start an agent loop, execute pending tasks without supervision, or run OODA cycles. Activates on "run ooda", "autonomous loop", "start ralph", "execute tasks with…

elasticdotventures/_b00t_ · 88 tokens