功能描述

将本地创建或修改的 Claude Code 技能自动同步到 GitHub 仓库。支持增量同步、单技能同步、自动生成 README.md。

使用说明 (SKILL.md)

GitHub Sync Skill - 技能同步工具

Name: Github Sync Skill
Author: kuiilabs

将本地技能自动同步到 GitHub 仓库的辅助工具。

触发场景

当用户要求：

把技能同步到 GitHub
发布技能到 GitHub
备份我的技能
更新 GitHub 上的技能仓库
"sync my skills to GitHub"
"把新创建的 skill 上传到 GitHub"

核心功能

1. 增量同步（默认）

自动检测远程仓库已有的技能
只同步本地有但远程没有的新技能
避免重复上传已存在的技能

2. 单技能同步

使用 --skill \x3Cskill-name> 指定同步单个技能
适合新创建技能后快速发布

3. 自动生成 README.md

每次同步后自动更新仓库的 README.md
包含所有技能的名称、描述、标签
提供安装和使用说明

4. Token 权限验证

检查 Token 有效性
验证 repo 权限
提供修复建议

使用方法

增量同步所有新技能（推荐）

# 自动检测并同步新技能
~/.claude/skills/github-sync-skill/scripts/sync_to_github.sh \
  --owner kuiilabs \
  --repo claude-skills \
  --token $GITHUB_TOKEN

同步单个技能

# 当你创建了 new-skill 后
~/.claude/skills/github-sync-skill/scripts/sync_to_github.sh \
  --skill new-skill \
  --owner kuiilabs \
  --repo claude-skills \
  --token $GITHUB_TOKEN

检查环境

# 检查 Git
git --version

# 检查 Token 环境变量
echo $GITHUB_TOKEN

验证 Token 权限

# 验证 Token 所有者
curl -s -H "Authorization: token $GITHUB_TOKEN" \
  https://api.github.com/user | jq -r '.login'

# 验证仓库权限
curl -s -H "Authorization: token $GITHUB_TOKEN" \
  https://api.github.com/repos/\x3Cowner>/\x3Crepo> | jq '.permissions'

输出格式

同步报告

============================================================
  GitHub Sync Report
============================================================

仓库：kuiilabs/claude-skills
时间：2026-04-04 19:32:09
同步模式：增量同步
状态：✅ 成功

仓库链接：https://github.com/kuiilabs/claude-skills

============================================================

README.md 自动更新

每次同步新技能后，README.md 会自动追加该技能的信息：

### \x3C技能名称>

\x3C技能描述>

**标签**: tag1, tag2, tag3

工作流程

增量同步流程

获取远程仓库已有的技能列表
对比本地用户创建的技能
识别新技能（本地有，远程没有）
上传新技能的所有文件
更新 README.md 添加新技能介绍
生成同步报告

单技能同步流程

验证指定的技能目录存在
上传该技能的所有文件
更新 README.md 添加该技能介绍
生成同步报告

注意事项

Token 安全: 不要将 Token 提交到代码仓库
权限要求: Token 需要 repo scope
网络环境: 需要能访问 GitHub API
冲突处理: 如有冲突需手动解决
README 更新: 每次同步会自动更新 README.md

安全最佳实践

Token 存储: 使用环境变量或密钥管理工具
Token 过期: 设置提醒定期更新（建议 30-90 天）
权限最小化: 仅授予必要权限
审计日志: 定期检查 GitHub 登录活动

故障排查

问题	错误信息	解决方案
Token 过期	`401 Bad credentials`	重新生成 Token
权限不足	`403 Resource not accessible`	添加 `repo` scope
仓库不存在	`404 Not Found`	先创建仓库
网络超时	`Connection timeout`	检查网络/代理设置
README 更新失败	`422 Unprocessable Entity`	检查文件编码和格式

示例场景

场景 1：创建了新技能后

# 你创建了 new-skill 目录
mkdir -p ~/.claude/skills/new-skill
# ... 编辑 SKILL.md 和脚本 ...

# 同步到 GitHub
~/.claude/skills/github-sync-skill/scripts/sync_to_github.sh \
  --skill new-skill

场景 2：定期同步所有新技能

# 自动检测并同步所有新创建的技能
~/.claude/skills/github-sync-skill/scripts/sync_to_github.sh

安全使用建议

Review the scripts before installing or running anything. Key points: - Inspect cleanup_remote_repo.sh carefully: it defaults to owner/repo = kuiilabs/claude-skills and includes a whitelist; when run with a token that has write/admin rights it will recursively delete remote repo contents (it asks for confirmation interactively, but this can be automated). Do NOT run this script unless you understand and have adjusted OWNER/REPO and the whitelist. - The package does not declare GITHUB_TOKEN as a required env var, but the scripts need a GitHub PAT with repo permissions. Use a least-privilege token scoped only to the repository you intend, and prefer a throwaway/rotated token for testing. - Test with --dry-run (or read-only API calls) first. Use verify_token.sh and check_changes.sh to validate environment and token behavior before syncing. - Run sync operations against a new/empty test repository you control to confirm behavior. Do not grant a wide-scoped token or run cleanup_remote_repo.sh against production repos until you fully understand and adapt its hard-coded defaults. - If you are unsure, ask the publisher for clarification (why cleanup script exists and why it's not documented) or consider forking/removing the cleanup script from the skill before use.

功能分析

Type: OpenClaw Skill Name: github-sync-skill Version: 2.0.0 The skill provides tools for syncing local files to GitHub, which involves high-risk capabilities such as handling GitHub Personal Access Tokens (PATs), reading local skill directories, and interacting with the GitHub API. While these actions align with the stated purpose, the inclusion of `scripts/cleanup_remote_repo.sh` is particularly risky as it performs recursive deletions of remote files not found on a hardcoded whitelist, potentially leading to accidental data loss. Furthermore, both `scripts/sync_to_github.sh` and the cleanup script use hardcoded default repository values (kuiilabs/claude-skills), which could result in unauthorized or unintended API calls if the agent or user fails to provide specific overrides.

能力标签

requires-oauth-token

能力评估

⚠ Purpose & Capability

The declared purpose (sync local Claude Code skills to GitHub, incremental sync, README generation, token verification) matches most of the included scripts (sync_to_github.sh, verify_token.sh, check_changes.sh). However, there is an additional cleanup_remote_repo.sh script that is not described in SKILL.md and provides recursive deletion of repo contents except a small whitelist. That destructive capability is not communicated in the description/instructions and appears tailored to a specific repository/owner; this mismatch is concerning.

⚠ Instruction Scope

The SKILL.md documents sync, single-skill upload, README update, and token checks and shows how to run sync and verify scripts. It does not mention the cleanup_remote_repo.sh script, which can delete many files in the remote repo. The scripts operate on ~/.claude/skills and GitHub API only (no unknown external endpoints), but the omission of the cleanup behavior in the runtime instructions is scope creep and dangerous if run unintentionally.

✓ Install Mechanism

This is an instruction-only skill (no install spec). That minimizes install-time risk; the runtime behavior is implemented in shell scripts included in the package. No external arbitrary downloads or archive extraction are performed by an installer.

⚠ Credentials

Registry metadata lists no required env vars, but the scripts and SKILL.md clearly expect a GitHub personal access token (GITHUB_TOKEN) and use it for create/update/delete operations. The token is sensitive and must have repo-level permissions for many operations. The absence of GITHUB_TOKEN in the declared requirements is an inconsistency. Also, cleanup_remote_repo.sh uses token with delete permissions and default OWNER/REPO constants—this combination can result in broad destructive effects if misused.

ℹ Persistence & Privilege

The skill does not request always:true or other elevated platform privileges, and it does not modify other skills' configurations. However, it includes a script that, when executed with a sufficiently privileged token, can permanently delete remote repository content. That is a high-impact action but is performed via the user's GitHub token rather than platform-level persistence.

版本历史

v2.0.0

Initial release on ClawHub

元数据

Slug github-sync-skill

版本 2.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题

Github Sync Skill 是什么？

将本地创建或修改的 Claude Code 技能自动同步到 GitHub 仓库。支持增量同步、单技能同步、自动生成 README.md。它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 82 次。

如何安装 Github Sync Skill？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install github-sync-skill」即可一键安装，无需额外配置。

Github Sync Skill 是免费的吗？

是的，Github Sync Skill 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。

Github Sync Skill 支持哪些平台？

Github Sync Skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Github Sync Skill？

由 Kuiil（@kuiilabs）开发并维护，当前版本 v2.0.0。

Github Sync Skill