publish-skills SKILL.md skillA
publish-skills from mr-kelly/skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add mr-kelly/skills/publish-skills@git:20260808.5ce8d82Pins git:20260808.5ce8d82 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- mr-kelly/skills
- Path
skills/publish-skills/SKILL.md- Versions recorded
- 4
- Latest version
- git:20260808.5ce8d82, committed Aug 8, 2026
- First version recorded
- Jul 1, 2026
- Size
- 13,754 bytes
- Repository stars
- 6
- License
- MIT
Publish agent skills AND MCP servers to every marketplace, plugin directory, and registry — security-scan for private data, validate with `gh skill`, cut a release, wire the Claude /plugin and Codex marketplaces, publish an MCP server to the official MCP Registry (mcp-publisher + server.json), and prep the curated / monetized stores (Buda Marketplace, Agensi, OpenClaw ClawHub) and review-gated directories (ChatGPT App Directory, Anthropic Connectors + Desktop Extensions/.mcpb). Use when the…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Publish Skills Publish a repo of agent skills (the open `SKILL.md` format) to the agent-skills marketplaces. The repo is the unit of publishing: make it public, validate, cut a release, and the auto-indexers (skills.sh, SkillsMP, claudeskills.info) pick it up. Then optionally wire the Claude `/plugin` marketplace and submit to the curated stores. **Golden rule: security first.** These repos often carry a local App-in-Skill with real data (emails, ledgers, tokens). Never publish it. Confirm private data is gitignored and scan tracked files before anything goes public. Run steps in order. Stop and surface anything a step can't resolve safely. --- ## Step 1 — Security scan (blocking) Publishing is outward-facing and hard to reverse. Verify BEFORE any push/release. ```bash # 1a. Private runtime state must be gitignored, never tracked grep -nE '\.data/|\.cache/|config\.local|\.env|exports/' .gitignore # expect these ignored git ls-files | grep -iE '\.data/|\.cache/|config\.local|\.env|\.pem|\.key' && echo "!!! TRACKED PRIVATE FILE — stop" || echo "clean: no private files tracked" # 1b. Scan tracked files for real secrets / PII (tune patterns per repo) …
Read the whole file at its exact version.
How to install
mdr add mr-kelly/skills/publish-skills@sha256:be7b3dfa2ba617d6The line at the top of this page pins the label git:20260808.5ce8d82, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_m7enyssxxf2qwdjs)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 4 versions of this file, between Jul 1, 2026 and Aug 8, 2026, about one every 13 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260808.5ce8d82 latest | 2026-08-08 | 5ce8d82 | 13,754 B | A | view · diff |
| git:20260701.c475230 | 2026-07-01 | c475230 | 13,671 B | A | view · diff |
| git:20260701.2282c54 | 2026-07-01 | 2282c54 | 13,290 B | A | view · diff |
| git:20260701.c708ede | 2026-07-01 | c708ede | 12,766 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (13754 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
mr-kelly/skills · 6 stars · license MIT · pushed 2026-11-04 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_m7enyssxxf2qwdjs GET https://markdownregistry.com/api/v1/resolve?ref=mr-kelly/skills/publish-skills GET https://markdownregistry.com/api/v1/blob/be7b3dfa2ba617d63f35b4d883bce0c8670b3bb41e9922cb552c24dfc5e953df
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.