publish-skills

Publish Skills

Publish a repo of agent skills (the open SKILL.md format) to the agent-skills marketplaces. The repo is the unit of publishing: make it public, validate, cut a release, and the auto-indexers (skills.sh, SkillsMP, claudeskills.info) pick it up. Then optionally wire the Claude /plugin marketplace and submit to the curated stores.

Golden rule: security first. These repos often carry a local App-in-Skill with real data (emails, ledgers, tokens). Never publish it. Confirm private data is gitignored and scan tracked files before anything goes public.

Run steps in order. Stop and surface anything a step can't resolve safely.

---

Step 1 — Security scan (blocking)

Publishing is outward-facing and hard to reverse. Verify BEFORE any push/release.

# 1a. Private runtime state must be gitignored, never tracked
grep -nE '\.data/|\.cache/|config\.local|\.env|exports/' .gitignore    # expect these ignored
git ls-files | grep -iE '\.data/|\.cache/|config\.local|\.env|\.pem|\.key' && echo "!!! TRACKED PRIVATE FILE — stop" || echo "clean: no private files tracked"

# 1b. Scan tracked files for real secrets / PII (tune patterns per repo)
git ls-files | while read f; do
  grep -HnaiE '(sk_live|sk_test|pk_live|bearer [A-Za-z0-9]|-----BEGIN|api[_-]?key["'"'"' :=]+[A-Za-z0-9]{16})' "$f" 2>/dev/null
done | grep -vE 'example\.com|_env"|password_env|api_key_env|REPLACE_WITH' | head

• Config templates must use example.com, Your Name, and *_env references — never real hosts, addresses, or key values.
• Third-party skills the user installed (e.g. a tracked .agents/skills/<other>/) must NOT be republished — untrack + gitignore them: git rm -r --cached .agents && printf '\n.agents/skills/\n' >> .gitignore

Only proceed when 1a and 1b are clean.

Step 2 — Validate & fix (gh skill)

GitHub's official tooling validates against the agentskills.io spec and discovers skills/*/SKILL.md, */SKILL.md, and plugins/{scope}/skills/*/SKILL.md.