Our review
Publishes a single registered skill through a mandatory quality gate: optimizer review, script validation, upload to the internal market, then Git publication.
Strengths
- Enforces step ordering: no market upload before validation passes, no commit or push before the upload completes.
- Distinguishes newly created skills (safe, in-scope optimizer fixes applied automatically) from existing skills (review plan still requires confirmation).
- Explicit hard stops — missing adapter, rejected upload, stale optimizer report, validation or Git failure — plus a rule against reporting a stopped run as a successful publication.
- Delegates a detailed semantic checklist to skill-optimizer: triggering, workflow order, failure handling, output contract, progressive disclosure, external dependencies, secrets, high-impact actions.
Limitations
- Tightly coupled to one repository layout (AGENTS.md, config/skills.json, scripts/*.py) and to SKILLS_MARKET_PUBLISHER pointing at the internal market executable.
- Handles exactly one skill per run; no batch mode or rollback procedure is described.
- What the validator actually checks is not spelled out, which limits diagnosis when it fails.
Use when a skill in the repository is ready and must be reviewed, validated and published in one guarded run.
Avoid it outside this repository's tooling, or to edit and publish several skills at once.
Security analysis
CautionThe skill orchestrates legitimate publication workflows using repository scripts, an external market adapter, and Git operations. There are no destructive, exfiltrating, or obfuscated instructions, but the automated external publication and repository mutation warrant caution.
- •Executes multiple Python scripts that modify repository state and publish to an external market.
- •Instructs Git commit and push operations after market upload, which can alter remote repository state.
- •Uses an environment variable pointing to an external executable for market publishing.
Examples
/publish-skill pdf-form-filler — this one was just created, so run the full gate end to end: optimize, validate, record the pass and publish it to the internal market./publish-skill code-review-helper — I changed its workflow, so review it with skill-optimizer and show me the plan before applying any changes./publish-skill data-cleaner — validate_skill.py failed last time; fix the in-scope issues, rerun the validator, and only then record the passed review and publish.Publish one registered Skill
Publish the Skill named in $ARGUMENTS through the repository's mandatory quality gate.
Execute these steps in order. Do not skip a step and do not represent a stopped or failed run as a successful publication.
- Read
AGENTS.mdandconfig/skills.json. Resolve exactly one directory atskills/$ARGUMENTS/. Stop if the Skill is missing, duplicated, or not registered. - Use the
skill-optimizerSkill to review only the target Skill. Cover triggering, workflow order, failure handling, confirmation gates, output contract, progressive disclosure, external dependencies, sensitive information, and high-impact actions. - For a newly created Skill, this
/publish-skillinvocation is explicit authorization to apply safe, in-scope optimizer changes automatically. Stop and ask before destructive changes, secret handling, external publication, or changes outside the target Skill. For an existing Skill, retain the optimizer's normal review-plan-confirmation gate. - Apply all approved optimizer fixes. If any required review item remains unresolved, stop before recording a pass.
- Run
python3 scripts/validate_skill.py $ARGUMENTS. Fix in-scope failures and rerun it. Do not continue until it exits successfully. - Only after the semantic review and deterministic validation both pass, run
python3 scripts/record_optimizer_review.py $ARGUMENTS --status passed. - Run
python3 scripts/publish_skill.py $ARGUMENTS.
SKILLS_MARKET_PUBLISHER must point to the configured internal-market executable. A missing adapter, rejected upload, stale optimizer report, validation failure, Git failure, or push failure is a hard stop. Market upload must complete before Git commit or push.
Docker Compose Architect
DevOps
Designs optimized Docker Compose configurations.
Incident Postmortem Writer
DevOps
Writes structured and blameless incident postmortem reports.
Runbook Creator
DevOps
Creates clear operational runbooks for common DevOps procedures.