skill-auto-publish

Publish a pre-reviewed skill to ClawHub and verify live registry state without relying on browser snapshots or CLI output alone. Use this skill when you have a skill ready to ship and need honest confirmation it landed correctly. Do not use this to decide whether a skill deserves release, that's a gate decision upstream. The skill enforces safe publish flow: input validation, secrets check, current state inspection, publish via CLI, registry verification, and public page check if accessible. Report status accurately, including any blocks, mismatches, or failures instead of pretending success.

inputs

• skill slug (string, required): kebab-case identifier for the skill in ClawHub registry. must not start with clawhub- (reserved by platform). example: my-skill-name.
• source path (string, absolute filesystem path, required): directory containing SKILL.md and skill assets. example: /home/user/projects/my-skill.
• target version (string, semver, required): release version in x.y.z format. example: 1.2.3.
• changelog (string, required): one specific release note or summary of changes. example: add decision points section, fix typos.
• expected live content (list of strings, required): what should appear, change, or be removed on the live published page. helps verify the publish landed correctly.
• release review status (string, optional): whether release review is completed. if required in your org and not completed, skill returns NEEDS_INFO instead of publishing.

external connections:

• clawhub cli (local binary, required): must be installed and accessible in PATH. used for clawhub publish and clawhub inspect commands. no auth token or env var typically needed if cli is local. if your clawhub instance requires auth, set CLAWHUB_AUTH_TOKEN env var with a valid token before running this skill.
• clawhub public registry (http/https, required): live registry endpoint where published skill becomes accessible. if behind a firewall, network timeout errors will occur. typical registry url is https://registry.clawhub.io but verify with local cli help.
• skill source repository (git or filesystem, optional): if skill source lives in git, ensure local checkout is up-to-date and on correct branch before publish.

edge cases to handle:

• rate limits on clawhub api (if hitting publish multiple times, wait 10-30 seconds between attempts).
• auth token expiry (if CLAWHUB_AUTH_TOKEN is set, verify it is still valid).
• network timeout connecting to live registry (retry once after 5 second delay).
• empty result set from clawhub inspect (means skill not yet published or slug does not exist).
• stale public page cache (may take 30-60 seconds to refresh after publish, do not fail immediately).
• missing SKILL.md in source path (blocks publish, return FAILED).
• credentials or secrets embedded in SKILL.md or skill code (blocks publish, return BLOCKED).

procedure

1. read and parse the publish request. extract slug, source path, target version, changelog, expected live content, and release review status from user input. store in structured format.

   • input: user request containing all required fields.
   • output: parsed object with fields: slug, source_path, target_version, changelog, expected_content, release_reviewed.

2. validate required inputs. confirm slug, source path, target version, and changelog are present and non-empty. if any is missing, return NEEDS_INFO and list missing fields.

   • input: parsed request object.
   • output: validation result (PASS or NEEDS_INFO with reason).

3. check source path exists and contains SKILL.md. verify the directory at source path exists and contains a SKILL.md file. if not found, return FAILED with explanation.

   • input: source_path string.
   • output: file existence check result, path to SKILL.md if found.

4. scan SKILL.md and skill directory for secrets or private credentials. look for hardcoded api keys, tokens, passwords, private urls, or ssh keys in SKILL.md and any code files in the directory. if found, return BLOCKED and list the issues. do not proceed to publish.

   • input: source_path, SKILL.md content.
   • output: secrets scan result (PASS or BLOCKED with list of findings).

5. check if slug already exists in live registry. run clawhub inspect <slug> to get current published version and metadata. if the skill exists, record current version. if it does not exist, confirm this is a first publish.

   • input: slug.
   • output: current live skill metadata or empty result if not published.

6. run publish command via local clawhub cli. execute clawhub publish <source_path> --version <target_version> --changelog "<changelog>". capture full command output and exit code. if command fails, return FAILED with command output.

   • input: source_path, target_version, changelog.
   • output: publish command exit code, stdout, stderr.

7. wait 3-5 seconds for registry sync. live registry may not update instantly. introduce short delay to let backend process the publish.

   • input: none.
   • output: none (timing only).

8. verify live registry state with clawhub inspect. run clawhub inspect <slug> again and compare returned version and metadata to target version and expected content. if version matches and content is as expected, verification is PASS. if version does not match or content is missing, return MISMATCH.

   • input: slug, target_version, expected_content.
   • output: registry verification result (PASS, MISMATCH, or FAILED if inspect command fails).

9. check public page if accessible. attempt to fetch the live public page for the skill (typically https://registry.clawhub.io/skills/<slug>). if page loads, check that expected content appears on the page. if page is blocked (403/404), report BLOCKED. if page loads but expected content is missing or different, report MISMATCH. if page loads and expected content is present, report PASS.

   • input: slug, expected_content.
   • output: public page verification result (PASS, BLOCKED, MISMATCH, or NOT_RUN if network error).

10. compile release report. construct a structured report with skill metadata, version info, urls, install command, verification status, any issues found, and next action. include all required fields per output contract.

    • input: slug, source_path, previous_version (from step 5), target_version, publish command output, registry verification result, public page verification result, issues list.
    • output: release report object with all fields populated.

decision points

• if release review is required and not completed: return NEEDS_INFO with message "release review required but not completed, cannot proceed to publish". do not call publish command.

• if any required input is missing (slug, source path, version, changelog): return NEEDS_INFO with message listing missing fields. do not proceed.

• if source path does not exist or does not contain SKILL.md: return FAILED with message "source path does not exist or SKILL.md not found at ". do not proceed.

• if secrets or private credentials are found in source directory: return BLOCKED with message "credentials found in source directory, cannot publish. remove or rotate: [list]". do not call publish command.

• if slug starts with clawhub- (reserved prefix): return BLOCKED with message "slug '' is reserved by ClawHub platform, choose a different slug".

• if clawhub inspect shows a current version and this is meant to be a first publish: return NEEDS_INFO with message "skill slug '' already exists at version , confirm you intend to update". do not proceed unless user confirms.

• if publish command exits with error: return FAILED with message "publish command failed" and include command output. do not proceed to verification.

• if registry verification is MISMATCH (version or content does not match expected): return PUBLISHED with status "published but verification failed". include details of what is mismatched. do not report PASS.

• if public page check times out or network is unreachable: return PUBLISHED with status "published and registry verified but public page check failed (network unreachable)". mark public page verification as NOT_RUN.

• if public page is blocked (403/404): return PUBLISHED with status "published and registry verified but public page is not accessible (blocked)". mark public page verification as BLOCKED.

• if public page loads but expected content is missing or mismatched: return PUBLISHED with status "published and registry verified but public page content is mismatched". list what was expected vs. what was found. do not claim success.

• if clawhub cli is not available (command not found): return FAILED with message "clawhub cli not found in PATH, install and configure before using this skill".

• if auth token is invalid or expired: return FAILED with message "authentication failed (invalid or expired token), refresh CLAWHUB_AUTH_TOKEN and retry".

output contract

return a structured report with the following fields, all populated:

publish_status: PUBLISHED | FAILED | BLOCKED | NEEDS_INFO
registry_verification: PASS | FAILED | MISMATCH | NOT_RUN
public_page_verification: PASS | BLOCKED | MISMATCH | NOT_RUN

skill:
source_path:
previous_version: (or "none" if first publish)
target_version:
url: (live skill page url, e.g. https://registry.clawhub.io/skills/my-skill)
install_command: (e.g. clawhub install my-skill@1.2.3)
command_used: (exact cli command executed, e.g. clawhub publish /path/to/skill --version 1.2.3 --changelog "...")
verified_by: clawhub inspect | public page | both | none
issues: (list of problems found, empty if none)
next_action: (what to do next, e.g. "monitor live page for cache refresh", "rotate credentials and retry", "update slug and republish")

return as json or plaintext table, whichever is clearer for the user.

outcome signal

the user knows the skill worked when:

• publish_status is PUBLISHED (not FAILED, BLOCKED, or NEEDS_INFO).
• registry_verification is PASS (version in clawhub inspect output matches target version).
• public_page_verification is PASS or BLOCKED (if blocked is acceptable in your org, check with owner, otherwise PASS is required).
• issues list is empty or contains only minor warnings (not blockers).
• next_action field is either "none" or describes optional follow-up steps like "monitor cache refresh", not required fixes.
• user can successfully run the install_command and retrieve the published skill.

if publish_status is not PUBLISHED, or registry_verification is MISMATCH or FAILED, the skill did not work. inspect errors in the issues list and follow next_action. do not assume success because the publish command printed "success" or similar. verify via clawhub inspect and live public page before confirming success to the user.