Publisher

Make your skills easy to understand and impossible to ignore

This tool appears internally consistent and does what it claims, but before running: (1) ensure you have authenticated `gh` and `clawdhub` (it will use your accounts to create repos and publish); (2) be aware it may update SKILL.md frontmatter, overwrite README.md, initialize a git repo, commit, and push — back up files if you want to review changes first; (3) the script prompts before destructive actions, but double-check the chosen one-liner and generated README content before confirming publish; (4) if you lack GitHub/ClawdHub auth, `gh`/`clawdhub` will control what happens (the script will fail rather than exfiltrate secrets).

Type: OpenClaw Skill Name: publisher Version: 1.0.6 The skill bundle's primary purpose is to generate documentation and publish skills to GitHub and ClawdHub, which involves legitimate but high-privilege actions like creating public GitHub repositories and pushing code. However, the `scripts/publish.sh` file contains code that attempts to set a 'reminder' using `cron` if GitHub repository creation fails. While the `cron` job is not fully implemented in the provided code (it only creates a temporary file and echoes a message), the explicit comment `# Note: In production, this would use the cron tool` indicates an intent to use a persistence mechanism, even if for a benign purpose. This design choice, even if not fully realized, elevates the classification to suspicious due to the potential for misuse of persistence.