360 Secure SkillHub
360 安全技能中心

Publish Skill Publisher

通用 Skill 发布工作流:用 Python 脚本校验 SKILL.md 格式与敏感信息,生成含中英双语 README、示例和 ClawHub 清单的发布包,再经 ClawHub 命令行或 GitHub PR 发布到三个目标仓库,并包含网络连通性与代理回退处理。

zhangyanbo2007
zhangyanbo2007
热度 29.21
最近更新 2026-05-18 11:50:36
分类:开发依赖:代码执行 / 读写文件 / 第三方 API应用场景:工作流 / 模板 / 自动化脚本 / DevOps

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add skill-publisher-universal
Metadata
name
skill-publisher
description
Generic publishing tool for Claude Code skills. Validates, packages, and publishes to ClawHub, Hermes Agent, and anthropics/skills with bilingual README support.
version
1.1.0
author
Claude Code
license
MIT
dependencies
[]
metadata
{"hermes":{"tags":["Skill","Publishing","ClawHub","Hermes","Claude","Workflow","Automation"],"related_skills":["ascii-excalidraw"]}}

Skill Publisher

A generic publishing workflow for any Claude Code skill. Package, validate, and publish to ClawHub (OpenClaw), Hermes Agent, and anthropics/skills (Claude Code).

When to Use

  • User wants to publish a skill they've built to one or more marketplaces
  • User needs a bilingual (EN/ZH) README for their skill
  • User wants to validate SKILL.md format before publishing
  • User needs help with clawhub publish or GitHub PR submission

Prerequisites

Before using this skill, check for the following in the environment (or ask the user):

Authentication

These tokens are pre-configured in ~/.env and shell environment. Read them automatically — do not ask the user:

Token Env Var Source
GitHub PAT GITHUB_TOKEN ~/.env or env
GitHub user GITHUB_USER ~/.env or env
ClawHub token CLAWHUB_TOKEN ~/.env or env

If a variable is missing, read ~/.env first, then ask the user.

Network Connectivity

Before any GitHub API call, test connectivity first:

curl -s -m 5 https://api.github.com/repos/NousResearch/hermes-agent > /dev/null 2>&1 && echo "direct OK" || echo "direct FAIL"

If direct access fails (common in restricted networks), load proxy from ~/.env:

source ~/.env
# ~/.env may contain (possibly commented-out):
# https_proxy=http://192.168.28.92:7897
# http_proxy=http://192.168.28.92:7897
# Export the proxy ONLY if direct access failed:
export https_proxy=http://192.168.28.92:7897
export http_proxy=http://192.168.28.92:7897
# Re-test with proxy:
https_proxy=$https_proxy curl -s -m 10 https://api.github.com/ > /dev/null 2>&1 && echo "proxy OK" || echo "proxy FAIL"

Fallback strategy (ordered by priority):

  1. Direct HTTPS access — works in unrestricted networks
  2. Proxy from ~/.env — read https_proxy/http_proxy values; if commented out, uncomment and export them for this session only
  3. SSH on port 22 — git@github.com:... works without proxy in most environments; use for git clone/push, but NOT for GitHub REST API (curl/gh api)

When proxy is also down: skip GitHub API PR creation. Push branch via SSH and instruct user to create PR manually via browser.

Workflow

Step 1: Validate Source Skill

python3 ~/.skills/skill-publisher/scripts/validate_skill.py <skill-path>

Checks: SKILL.md exists, valid YAML frontmatter, required fields (name, description), name format (lowercase, hyphens), description <= 1024 chars, no hardcoded secrets, file size <= 100,000 chars.

Step 2: Generate Publish Package

python3 ~/.skills/skill-publisher/scripts/generate_package.py \
  --source ~/.skills/<skill-name> \
  --output /tmp/publish-<skill-name> \
  --platforms clawhub hermes anthropics

Produces:

/tmp/publish-<skill-name>/
├── SKILL.md            # Copied from source
├── README.md           # Bilingual (EN/ZH) README with examples
├── examples/           # Copied from source skill
└── .clawhub.json       # ClawHub manifest

Step 3: Platform-Specific Publishing

ClawHub (OpenClaw)

CRITICAL: Always pass --slug <skill-name> to prevent ClawHub from using the directory name as the slug. Without --slug, a publish from /tmp/publish-my-skill/ would create a duplicate entry named publish-my-skill instead of my-skill.

clawhub publish /tmp/publish-<skill-name> --version <version> --slug <skill-name>

If CLI unavailable: install npm i -g clawhub or upload via clawhub.ai.

Hermes Agent (GitHub PR)

Target: NousResearch/hermes-agent → skills/creative/<skill-name>/SKILL.md

  1. Fork repo on GitHub
  2. Clone fork, copy SKILL.md to skills/creative/<skill-name>/
  3. Commit, push, create PR

anthropics/skills (GitHub PR)

Target: anthropics/skills → skills/<skill-name>/SKILL.md

Same process as Hermes, different repo.

Step 4: Verify

# ClawHub
curl -s "https://clawhub.ai/api/v1/skills?slug=<skill-name>"
# Hermes / anthropics — check raw GitHub URLs

Helper Scripts

Script Purpose
scripts/validate_skill.py Validate SKILL.md format
scripts/generate_package.py Generate publish package with bilingual README
scripts/gen_clawhub_manifest.py Generate .clawhub.json
scripts/create_pr.py Create GitHub PR via API

Common Pitfalls

  1. SKILL.md first bytes must be --- — no BOM, no blank line
  2. ClawHub rejects hardcoded secrets — scan scripts/ before publishing
  3. Hermes requires metadata — metadata.hermes.tags and related_skills
  4. Network issues — always test connectivity first. If direct HTTPS fails, load proxy from ~/.env and re-test. If proxy also fails, use SSH (git@github.com:...) for git operations and tell user to create PR manually via browser
  5. ClawHub slug mismatch — always pass --slug <skill-name> when publishing; otherwise the directory name becomes the slug, creating a wrong/duplicate entry (e.g. publish-my-skill instead of my-skill)