Skill Sync Publisher

Skill Sync Publisher

Use the bundled CLI to preflight and synchronize one local skill directory. The source GitHub repository is canonical; registry entries are projections of that source. Read references/platform-matrix.md before working with a platform and references/security-policy.md when preflight reports a security finding.

Safety rules

• Start with python3 scripts/sync.py preflight or --dry-run.
• Never collect or store passwords, tokens, cookies, or private keys.
• Ask before the first submission to each platform. Persist choices per GitHub repository, skill path, and platform in the user state file, not the repo.
• Require the user to complete login before running an authenticated identity check. A failed check blocks only that platform.
• Show the exact diff and commit scope before GitHub commit/push.
• Use official CLIs when available. For directory sites without a supported API/CLI, create a browser/manual handoff instead of inventing an endpoint.
• Never touch unrelated dirty files, force-push, or roll back successful targets.

Commands

Run bin/skill-sync from this skill directory, or replace it with python3 scripts/sync.py when invoking the implementation directly:

bin/skill-sync init 
bin/skill-sync preflight 
bin/skill-sync sync  --dry-run --json
bin/skill-sync sync  --platform github,clawhub
bin/skill-sync sync  --resume
bin/skill-sync status 
bin/skill-sync reset-choice  
bin/skill-sync reset-all 
bin/skill-sync forget 

sync is confirmation-gated by default. --yes is intended for an already reviewed, authenticated automation job; it does not bypass platform choice or security blockers. The CLI returns non-zero if a selected platform fails or is blocked.

Platform behavior

• GitHub: commit and push only the target skill files after confirmation.
• Awesome Codex Plugins: create/update a PR only when a valid plugin manifest exists; ordinary skills are blocked unless the caller explicitly uses the future --as-plugin projection.
• HOL Registry: use the official npx @hol-org/registry quote/publish flow.
• ClawHub: use clawhub whoami, dry-run, then semver publish.
• skills.sh, SkillsMP, LobeHub, Cursor Directory: verify public GitHub source and produce/check an index or browser handoff; do not pretend these are file upload APIs. A planned result means the user must complete the displayed web submission/verification step and rerun status; it is not recorded as a successful publication.

Keep platform-specific commands and URLs in the reference file so they can be updated without bloating this workflow.