nuget-trusted-publishing SKILL.md skillA
nuget-trusted-publishing from dotnet/skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add dotnet/skills/nuget-trusted-publishing@git:20260629.4975793Pins git:20260629.4975793 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- dotnet/skills
- Path
plugins/dotnet-advanced/skills/nuget-trusted-publishing/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260629.4975793, committed Jun 29, 2026
- Size
- 9,361 bytes
- Repository stars
- 5,788
- License
- MIT
Set up NuGet trusted publishing (OIDC) on a GitHub Actions repo — replaces long-lived API keys with short-lived tokens. USE FOR: trusted publishing, NuGet OIDC, keyless NuGet publish, migrate from NuGet API key, NuGet/login, secure NuGet publishing. DO NOT USE FOR: publishing to private feeds or Azure Artifacts (OIDC is nuget.org only). INVOKES: shell (powershell or bash), edit, create, ask_user for guided repo setup.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# NuGet Trusted Publishing Setup Set up [NuGet trusted publishing](https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-publishing) on a GitHub Actions repo. Replaces long-lived API keys with OIDC-based short-lived tokens — no secrets to rotate or leak. ## Prerequisites - **GitHub Actions** — this skill covers GitHub Actions setup only - **nuget.org account** — the user needs access to create trusted publishing policies ## When to Use This Skill Use this skill when: - Setting up trusted publishing for a NuGet package - Migrating from `secrets.NUGET_API_KEY` to OIDC-based publishing - Asked about keyless or secure NuGet publishing - Creating a new NuGet publish workflow from scratch - Asked to "remove NuGet API key" or "use NuGet/login" - Setting up publishing for a dotnet tool, MCP server, or template package - Asked about `NuGet/login@v1` or `id-token: write` ## Safety Rules > ⚠️ **Bail-out rule**: If any phase fails after one fix attempt on an infrastructure/auth issue, stop and ask the user. Don't loop on environment problems. …
Read the whole file at its exact version.
How to install
mdr add dotnet/skills/nuget-trusted-publishing@sha256:e12a67e1239989a3The line at the top of this page pins the label git:20260629.4975793, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_z7c3bphpqtu63lm6)
5 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Jun 29, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9361 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
dotnet/skills · 5,788 stars · license MIT · pushed 2026-11-01 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_z7c3bphpqtu63lm6 GET https://markdownregistry.com/api/v1/resolve?ref=dotnet/skills/nuget-trusted-publishing GET https://markdownregistry.com/api/v1/blob/e12a67e1239989a36b8835b715daf94a4223c89fbc21336bb24107f51363c3e5
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.