Skill Publisher Claw Skill

Prepare and audit a Claw skill for public release by validating structure, security, portability, documentation, testing, git hygiene, and metadata.

This toolkit appears coherent for preparing and publishing skills, but it performs file and git operations — review the scripts before running. Recommended precautions: - Inspect publish.sh, fix.sh, and scaffold.sh to understand exactly what will be changed/committed. - Run audit.sh and score.sh in a disposable copy of your repository first (do not run publish.sh on a repo you can't restore). - If you don't want automatic pushes, avoid running publish.sh or run it with caution; remove/configure the 'gh' CLI auth if you don't want remote creation/push. - Backup or ensure a clean git branch before letting fix.sh apply automated edits (fix.sh does in-place sed replacements and can commit changes via publish.sh). - If you allow an autonomous agent to call this skill, restrict it or ensure GitHub CLI is not authenticated in that runtime environment to prevent unintended pushes. Overall: coherent and expected behavior for a publisher tool, but treat it like any script that modifies your repo — review and run in a controlled environment.

Type: OpenClaw Skill Name: skill-publisher-claw-skill Version: 0.1.0 This OpenClaw skill bundle is designed to audit, fix, scaffold, and publish other OpenClaw skills. All included shell scripts (`audit.sh`, `fix.sh`, `publish.sh`, `scaffold.sh`, `analyze.sh`, `score.sh`, `validate-links.sh`, `changelog.sh`) and the `SKILL.md` instructions are clearly aligned with this stated purpose. The `SKILL.md` and `audit.sh` contain `grep` commands to search for secrets (e.g., API keys, passwords) and personal data, but these are intended to *find* and *remove* such sensitive information from the *audited skill*, not to exfiltrate data from the agent's environment or the host system. Network calls (e.g., `git push`, `gh repo create`, `curl` for link validation) are legitimate actions for publishing and validating a skill. There is no evidence of intentional harmful behavior, prompt injection with malicious objectives, or unauthorized data exfiltration.