publish-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited publish-skills (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Publish personal Claude skills to a GitHub repository for sharing and versioning.
_Read ~/.claude/skills/publish-skills/preferences.md using the Read tool. If not found, no preferences are set._
_On startup, use the Glob tool to find ~/.claude/skills/*/SKILL.md to count skills, and read preferences (above) to extract repo-path and last-published._
Check $ARGUMENTS:
~/.claude/skills/publish-skills/preferences.md, confirm, stopPublish Skills — Share Claude skills via GitHub
Usage:
/publish-skills Publish all skills to GitHub repo
/publish-skills --preview Show what would change without publishing
/publish-skills --diff Show diff between local and published
/publish-skills --skip-audit Publish without pre-publish audit checks
/publish-skills config Set repo path and GitHub remote
/publish-skills reset Clear preferences
/publish-skills help This help
What it does:
1. Copies skill files to the publish repo (excludes preferences, audit logs)
2. Generates a README.md catalog from skill descriptions
3. Commits changes with a summary message
4. Pushes to GitHub
What gets published:
- SKILLS_GUIDE.md (design guide)
- Each skill's SKILL.md
- Each skill's reference/ and examples/ directories
- Auto-generated README.md catalog
What stays private:
- preferences.md files (user-specific config)
- last-audit.md (audit logs)
- Any file matching .gitignore patterns
Current preferences:
(shown above under Preferences)Use `AskUserQuestion`:
Q1 — "GitHub repo path?" (text input)
~/Dev/claude-skillsQ2 — "GitHub remote URL?" (text input)
[email protected]:username/claude-skills.gitQ3 — "Commit style?" (Auto-summary (default) — list changed skills, Custom — ask each time)
Save to ~/.claude/skills/publish-skills/preferences.md.
If no preferences file exists:
~/Dev/claude-skills (Recommended), custom path[email protected]:username/claude-skills.git)If the repo path doesn't exist or isn't a git repo:
mkdir -p {repo-path}cd {repo-path} && git init.gitignore: preferences.md
last-audit.md
.DS_Storegit remote add origin {remote-url}If remote repo doesn't exist, inform: "Repo initialized locally. Create the repo on GitHub first, then run /publish-skills again to push."
Read preferences for repo-path and remote-url.
Find all local skills:
~/.claude/skills/*/SKILL.mdFor each skill, extract from frontmatter:
namedescriptionargument-hintdisable-model-invocationAlso note if the skill has reference/ or examples/ directories.
Compare with published repo to detect changes:
# For each local skill, diff against published version
# (this repo uses code/ as the skill directory, not skills/)
diff ~/.claude/skills/{skill-name}/SKILL.md {repo-path}/code/{skill-name}/SKILL.mdCategorize each skill:
Also check if SKILLS_GUIDE.md changed.
Skip this step if `--skip-audit` flag is present.
For each skill being considered for publish (new or changed), run these quick checks inline:
description present and third-persondisable-model-invocation matches side-effect profile (has Write/Edit/Bash mutations = needs true)allowed-tools presentpreferences.md files being includedIf any skill fails checks, show warnings alongside the diff summary:
⚠️ /skill-name: missing disable-model-invocation (has side effects)
⚠️ /skill-name: description not third-personUse `AskUserQuestion`: "{N} skills have audit warnings. Publish anyway? / Fix first / Skip those skills"
Show a summary of what would be published:
Skills to publish:
New:
+ /skill-name — short description
+ /skill-name — short description
Changed:
~ /skill-name — short description
~ /skill-name — short description
Unchanged:
= /skill-name (skipped)
= /skill-name (skipped)
Removed from repo:
- /skill-name (no longer exists locally)
Also: SKILLS_GUIDE.md (changed/unchanged)Use `AskUserQuestion` (multiSelect: true):
Only proceed with the skills the user explicitly selects. Never auto-publish.
Only copy the skills the user approved:
For each approved skill:
# Create skill dir in repo (this repo uses code/, not skills/)
mkdir -p {repo-path}/code/{skill-name}
# Copy SKILL.md (always)
cp ~/.claude/skills/{skill-name}/SKILL.md {repo-path}/code/{skill-name}/
# Copy DESIGN.md if exists (renderer contract for UI-rendering skills —
# convention added by skill-creator manifest items 26-30, 2026-05-13)
if [ -f ~/.claude/skills/{skill-name}/DESIGN.md ]; then
cp ~/.claude/skills/{skill-name}/DESIGN.md {repo-path}/code/{skill-name}/
fi
# Copy icon if exists (icon.svg or icon.png at the skill root)
for ext in svg png; do
if [ -f ~/.claude/skills/{skill-name}/icon.$ext ]; then
cp ~/.claude/skills/{skill-name}/icon.$ext {repo-path}/code/{skill-name}/
fi
done
# Copy reference/ if exists
if [ -d ~/.claude/skills/{skill-name}/reference ]; then
cp -r ~/.claude/skills/{skill-name}/reference {repo-path}/code/{skill-name}/
fi
# Copy examples/ if exists
if [ -d ~/.claude/skills/{skill-name}/examples ]; then
cp -r ~/.claude/skills/{skill-name}/examples {repo-path}/code/{skill-name}/
fi
# Copy templates/ if exists (skill-creator manifest item 25)
if [ -d ~/.claude/skills/{skill-name}/templates ]; then
cp -r ~/.claude/skills/{skill-name}/templates {repo-path}/code/{skill-name}/
fiNever copy these (user-specific or runtime artefacts, must stay local):
preferences.md · feedback-journal.md · anonymise.denyreports/ · sessions/ · resume-state.md · last-audit.mdThese are also .gitignore'd in the publish repo as defense-in-depth.
For each approved removal:
rm -rf {repo-path}/code/{skill-name}Copy SKILLS_GUIDE.md (if changed and user approved):
cp ~/.claude/skills/SKILLS_GUIDE.md {repo-path}/Build the catalog:
# Claude Skills
Personal collection of Claude Code skills for developer workflows.
## Quick Start
To use these skills, copy them to your `~/.claude/skills/` directory:
git clone {remote-url} cp -r claude-skills/skills/* ~/.claude/skills/
cp -r claude-skills/skills/whats-next ~/.claude/skills/
## Skills Catalog
| Skill | Description | Side Effects |
|-------|-------------|:------------:|
| [`/address-pr-comments`](skills/address-pr-comments/SKILL.md) | {short description} | Yes |
| [`/audit-skills`](skills/audit-skills/SKILL.md) | {short description} | No |
| ... | ... | ... |
## Skill Details
### `/skill-name`
{full description from frontmatter}
**Usage:** `/skill-name {argument-hint}`
{link to SKILL.md}
---
## Design Guide
These skills follow a consistent [design guide](SKILLS_GUIDE.md) with:
- CLI-style help, config, and reset subcommands
- Persistent preferences per skill
- First-time setup guidance
- Learning from user corrections
## License
MITFor the catalog table:
disable-model-invocation: true, "No" otherwiseIf `--preview`: Steps 2-3 already showed the changes — stop here without modifying the repo.
If `--diff`: Run git -C {repo-path} diff and show, then stop.
Otherwise (after user confirmed in step 3):
Stage only the approved files:
cd {repo-path}
git add skills/{approved-skill-1}/ skills/{approved-skill-2}/ README.md SKILLS_GUIDE.md
git status --shortBuild commit message from what was approved:
Update skills: {list of approved skill names}
Added: {comma-separated list of new skills}
Updated: {comma-separated list of changed skills}
Removed: {comma-separated list of removed skills}Show the staged diff summary and ask for final confirmation:
Use `AskUserQuestion`:
Then execute based on choice:
git -C {repo-path} commit -m "{message}"
git -C {repo-path} push origin main # only if user chose pushIf push fails (no remote repo): "Committed locally but push failed. Make sure the GitHub repo exists and you have push access."
Update last-published in preferences file.
Published {N} skills to {remote-url}
Added: {list}
Updated: {list}
Removed: {list}
Skipped: {list of unchanged or user-excluded skills}
Commit: {hash} "{message}"
Repo: {remote-url}
README catalog updated with {N} skills.If any skills had audit warnings during step 2.5, append:
Tip: run /audit-skills --fix to resolve all issues before publishing.If user changes repo path, update preference. If user consistently excludes certain skills, note that pattern. If user consistently uses --preview first, note that pattern.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.