skill-manager · diff
v4.1.0 to v4.2.0
57 added, 3 removed. Audit A to A.
---
name: skill-manager
- version: 4.1.0
+ version: 4.2.0
description: |
- Search, install, and publish skills across official, community, and global registries.
+ Search, install, publish, and delete skills across official, community, and global registries.
- Use when finding or sharing skills (e.g. install a "funding rate" skill, list installed skills, publish my custom skill to the registry).
+ Use when finding, sharing, or removing skills (e.g. install a "funding rate" skill, list installed skills, publish my custom skill to the registry, delete a published skill).
metadata:
starchild:
emoji: "📦"
skillKey: skill-manager
user-invocable: true
---
# Skills
## Searching & Installing Skills
**Always use the `search_skills` tool.** Do NOT manually curl, browse GitHub, or download SKILL.md files.
`search_skills` does everything automatically:
1. **Local** — checks installed skills first
2. **Starchild community** — searches community-skills index
3. **skills.sh** — searches the global skills ecosystem (OpenClaw, Vercel, Anthropic, etc.)
4. **Auto-install** — installs the best match via `npx skills add` (default: `auto_install=true`)
### Usage
```
search_skills(query="deploy") # search + auto-install best match
search_skills(query="trading") # search + auto-install
search_skills(query="k8s", auto_install=false) # search only, don't install
search_skills() # list all installed skills
```
After `search_skills` installs a skill, it's immediately available. Call `skill_refresh()` only if you manually edited skill files.
### What NOT to do
- Do NOT `curl` GitHub repos to browse/download skills
- Do NOT `mkdir -p skills/<name>` and manually write SKILL.md
- Do NOT use `web_fetch` to download skill files
- Do NOT use the old gateway search/install endpoints (they no longer exist)
---
## Publishing (Starchild Only)
Publishing still uses the gateway. Only Starchild-authored skills can be published.
### SKILL.md Requirements
```yaml
---
name: my-skill
version: 1.0.0
description: What this skill does
author: your-name
tags: [tag1, tag2]
---
```
| Field | Required | Rules |
|-------|----------|-------|
| `name` | Yes | Lowercase, alphanumeric + hyphens, 2-64 chars |
| `version` | Yes | Semver (e.g. `1.0.0`) — immutable once published |
| `description` | Recommended | Short summary for search |
| `author` | Recommended | Author name |
| `tags` | Recommended | Array of tags for discoverability |
### Publish Workflow
**Step 1: Validate the skill directory**
```bash
SKILL_DIR="./skills/my-skill"
head -20 "$SKILL_DIR/SKILL.md"
```
**Step 2: Get OIDC token**
```bash
TOKEN=$(curl -s --unix-socket /.fly/api \
-X POST -H "Content-Type: application/json" \
"http://localhost/v1/tokens/oidc" \
-d '{"aud": "skills-market-gateway"}')
```
**Step 3: Build and send publish request**
```bash
SKILL_DIR="./skills/my-skill"
GATEWAY="https://skills-market-gateway.fly.dev"
PAYLOAD=$(python3 -c "
import os, json
files = {}
for root, dirs, fnames in os.walk('$SKILL_DIR'):
for f in fnames:
full = os.path.join(root, f)
rel = os.path.relpath(full, '$SKILL_DIR')
with open(full) as fh:
files[rel] = fh.read()
print(json.dumps({'files': files}))
")
curl -s -X POST "$GATEWAY/skills/publish" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d "$PAYLOAD" | python3 -m json.tool
```
### Response (201)
```json
{
"namespace": "@554",
"name": "my-skill",
"version": "1.0.0",
"tag": "@554/my-skill@1.0.0",
"download_url": "https://github.com/.../bundle.zip",
"release_url": "https://github.com/.../releases/tag/..."
}
```
### Version Rules
- Each version is **immutable** — once published, it cannot be overwritten.
- To update, bump the version and publish again.
---
+ ## Deleting a Published Skill
+
+ Delete a skill you previously published to the Starchild community registry. This removes all files, tags, releases, and the skills.json index entry from the community repo.
+
+ **You can only delete skills in your own namespace** (`@{user_id}`).
+
+ ### Delete Workflow
+
+ **Step 1: Get OIDC token**
+
+ ```bash
+ TOKEN=$(curl -s --unix-socket /.fly/api \
+ -X POST -H "Content-Type: application/json" \
+ "http://localhost/v1/tokens/oidc" \
+ -d '{"aud": "skills-market-gateway"}')
+ ```
+
+ **Step 2: Send delete request**
+
+ ```bash
+ GATEWAY="https://skills-market-gateway.fly.dev"
+ NAMESPACE="YOUR_USER_ID" # without @ prefix
+ SKILLNAME="my-skill"
+
+ curl -s -X DELETE "$GATEWAY/skills/$NAMESPACE/$SKILLNAME" \
+ -H "Authorization: Bearer $TOKEN" | python3 -m json.tool
+ ```
+
+ ### Response (200)
+
+ ```json
+ {
+ "namespace": "@554",
+ "name": "my-skill",
+ "commit_sha": "abc123...",
+ "deleted_tags": ["@554/my-skill@1.0.0", "@554/my-skill@1.1.0"],
+ "deleted_releases": [42, 43]
+ }
+ ```
+
+ Returns **404** if the skill doesn't exist, **403** if you're not the owner.
+
+ ### After Deletion
+
+ - The skill is removed from the community registry (skills.json, GitHub releases, tags, and source files).
+ - If the skill is still installed locally, the local copy remains. Use `skill_manage(action="delete", name="my-skill")` to also remove the local copy.
+
+ ---
+
## Decision Tree
```
User wants to find/install a skill
→ Use search_skills(query) tool — it searches all sources and auto-installs
→ NEVER curl GitHub or manually download files
User wants to list installed skills
→ Use search_skills() with no query
User wants to publish a skill
→ Validate SKILL.md frontmatter
→ Get OIDC token (audience: skills-market-gateway)
→ POST to /skills/publish
+
+ User wants to delete a published skill
+ → Get OIDC token (audience: skills-market-gateway)
+ → DELETE /skills/:namespace/:name
+ → Optionally remove local copy with skill_manage(action="delete")
User wants to create a new skill
→ Read the skill-creator skill first
```