Skill: ivangdavila/skill-publish (version 1.0.0)

--- name: "Skill Publish" description: "Safely publish skills to ClawHub. Sanitize, format, verify, and publish without modifying your local files." --- ## Publish Skills Safely Transform any knowledge into a publishable skill. Sanitize personal data, format correctly, verify before publishing. **Key principle:** Never modify user's original files. Create clean publish-ready version separately. **References:** - `sanitize.md` — Security checklist and personal data removal - `transform.md` — Convert any format to proper skill structure - `verify.md` — Pre-publish verification process --- ### When to Use - User wants to publish existing skill/instructions to ClawHub - User wants to share knowledge they've developed locally - User has content in any format that should become a public skill ### The Process 1. **Understand** — What knowledge/skill exists? Where is it? 2. **Transform** — Convert to proper skill format (see `transform.md`) 3. **Sanitize** — Remove personal/dangerous content (see `sanitize.md`) 4. **Verify** — Confirm with user before publishing (see `verify.md`) 5. **Publish** — Only after explicit approval ### Critical Rules ⚠️ **Never modify original files** — Create separate publish version ⚠️ **Never publish without sanitization** — Check `sanitize.md` ⚠️ **Never publish without user approval** — Always verify first ⚠️ **When in doubt, include more** — User can remove, harder to add later ### Asking the User Before transforming, clarify: - What should be PUBLIC vs kept private? - Any specific names/references to remove? - Target audience (beginners, experts, specific domain)? - Desired slug/name for ClawHub? --- **Always run `sanitize.md` checklist before any publish.**

path: sanitize.md
content: # Sanitization Checklist

**Run this BEFORE any publish.** Public skills are permanent.

## Personal Data

Remove or genericize:
- [ ] Names (your name, team members, company)
- [ ] Email addresses
- [ ] Usernames, handles, IDs
- [ ] Phone numbers
- [ ] Addresses, locations
- [ ] URLs to private resources
- [ ] Internal project names
- [ ] Client/customer references

## Credentials & Secrets

**NEVER include:**
- [ ] API keys, tokens, passwords
- [ ] Environment variable VALUES (names are ok)
- [ ] Private URLs with auth params
- [ ] Database connection strings
- [ ] SSH keys, certificates

## Model-Specific References

Remove references to specific models that won't apply to all users:
- [ ] "Claude" → "the agent" or "the model"
- [ ] "GPT" → generic term
- [ ] Specific model versions
- [ ] Provider-specific features

## Internal References

Remove:
- [ ] References to your specific file paths
- [ ] Your workspace structure
- [ ] Your tool configurations
- [ ] Internal documentation links
- [ ] Team-specific workflows

## Dangerous Patterns

Check for:
- [ ] Commands that could damage systems
- [ ] Patterns that encourage unsafe behavior
- [ ] Hardcoded paths that won't work elsewhere
- [ ] Assumptions about user's environment

## Genericize Examples

Replace specific with generic:
- `~/my-company/project` → `~/projects/example`
- `[REDACTED_SECRET]` → `[REDACTED_SECRET]`
- `api.mycompany.com` → `api.example.com`
- Internal tool names → generic descriptions

## Final Check

Before publishing, read entire skill asking:
- "Would I be comfortable if this were public forever?"
- "Could this expose anything about me/my company?"
- "Would this work for someone with zero context about me?"

## If Unsure

**Ask the user:**
> "I found [X] which might be personal/internal. Should I remove, genericize, or keep it?"

Better to ask than to publish something private.


path: transform.md
content: # Transforming Content to Skill Format

Reference — how to convert any knowledge into proper skill structure.

## Source Types

### Already a Skill
- Copy to separate publish folder
- Run sanitization
- Verify structure meets standards

### Instructions in Files
- Read and understand the full process
- Extract core actionable instructions
- Remove personal context, keep universal value
- Structure into SKILL.md + auxiliaries

### Knowledge You've Developed
- Document what you know about the topic
- Focus on WHAT TO DO, not explanations
- Include the non-obvious parts
- Ask user to confirm you captured it correctly

### User's Request to Share Something
- Ask: "What specifically should this skill help others do?"
- Ask: "What do you do that others might not know?"
- Condense their workflow into reusable instructions

## Transformation Rules

### Keep
- Actionable instructions
- Non-obvious insights
- Useful patterns
- Practical examples (genericized)

### Remove
- Personal context
- Explanations of basics
- Verbose descriptions
- Meta-commentary

### Restructure
- SKILL.md: Core instructions only (30-50 lines ideal)
- Auxiliary files: Details, references, patterns
- Progressive disclosure: Load details only when needed

## Standard Structure

```
publish-folder/
├── SKILL.md          ← Core instructions
├── FILES.txt         ← List of files to publish
└── [topic].md        ← Supporting details
```

## When Unsure What to Include

**Default: Include it.** Easier for user to remove than to add later.

Mark uncertain sections:
> "I included [X] — let me know if this should be removed or modified."

## Verify Understanding

Before finalizing, confirm with user:
1. "Here's what I understood as the core value: [summary]"
2. "I'm including these sections: [list]"
3. "I'm excluding: [list with reasons]"
4. "Any changes before I prepare the publish version?"


path: verify.md
content: # Pre-Publish Verification

**Never publish without completing this process.**

## Create Publish Folder

Work in a SEPARATE folder, never modify originals:
```
/tmp/publish-[slug]/
├── SKILL.md
├── FILES.txt
└── [auxiliaries]
```

## Verification Message

Before publishing, send user a verification with:

### Required Information
- **Slug:** exact slug to use
- **Name:** exact display name
- **Version:** version number
- **Description:** exact description text
- **Files:** complete list of files to publish

### Content Summary
- Brief summary of what the skill does
- Key sections/topics covered
- Any notable inclusions or exclusions

### Sanitization Confirmation
- "Checked for personal data: ✓"
- "Checked for credentials: ✓"
- "Checked for model-specific references: ✓"
- Note any items that were removed/genericized

## Wait for Approval

**Do not proceed without explicit approval.**

User should confirm:
- Slug is correct
- Name is correct
- Description is correct
- Content looks right
- Ready to publish

## Publish Command

Only after approval:
```bash
npx clawhub publish <folder> \
  --slug "<slug>" \
  --name "<name>" \
  --version "<version>"
```

## Post-Publish Verification

After publishing:
1. Confirm success message
2. Optionally install to verify: `npx clawhub install <slug> --dir /tmp/verify`
3. Report to user: "Published [slug]@[version]"

## If Something Goes Wrong

- Wrong slug? Cannot change. Contact ClawHub support.
- Wrong content? Publish new version with fix.
- Exposed private data? Publish sanitized version ASAP, contact support.

## Version Guidelines

- `1.0.0` — First publish
- `1.0.1` — Small fixes (typos, clarifications)
- `1.1.0` — New content/features
- `2.0.0` — Major restructure


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)