publish-skill-repo

将当前项目中的 Skill 发布到 GitHub 并同步到 ClawHub。新项目自动走完流程，已有仓库的项目会总结变更、确认提交信息和建议版本号。

This skill appears to do what it says, but it will modify your repository and GitHub account (create repos, commit files, push, create tags, and set repository secrets). Before running: 1) review scripts/publish-skill-repo.sh and the generated workflow to ensure you trust them; 2) back up or test in a throwaway repo; 3) verify your gh CLI is logged into the intended GitHub account; 4) confirm the ClawHub token in ~/.clawhub/secret_token is correct and that you are comfortable it will be stored as the repo secret CLAWHUB_TOKEN; 5) consider running the script manually once to observe behavior (there is no built-in dry-run). If you are unsure, run the script on a non-production repo first and inspect the created .github/workflows/publish-to-clawhub.yml before pushing.

Type: OpenClaw Skill Name: publish-skill-repo Version: 2.0.1 The skill bundle automates the creation of GitHub repositories and the deployment of skills to ClawHub, which involves high-risk operations. Specifically, the script `scripts/publish-skill-repo.sh` reads a sensitive API token from `~/.clawhub/secret_token` and uploads it to GitHub Secrets using the `gh` CLI. While these actions are consistent with the stated purpose of setting up CI/CD for the ClawHub platform, the broad permissions required to manage GitHub repositories and handle authentication tokens represent a significant attack surface if the skill were to be repurposed or if the `clawhub` npm package were compromised.