fluxly Search skills… ⌘K 中文 Sign in Publish

Publish a skill

Open a pull request — the audit pipeline does the rest.

Fill the fields below and write the body — that is enough to ship a skill here. Submitting queues it for the next ingest cycle; prefer a GitHub PR? Download the generated SKILL.md from the right column.

Write a skill right here

Fill the form on the left, watch the generated SKILL.md on the right. Submit sends it to our ingest queue; if the API is not enabled yet we fall back to a local download so you can open a PR manually.

name (kebab-case)description (≤ 140 chars)0/140

categorylicenseversion

compatible agents

tags (comma-separated)body (markdown)contact email (optional)

Generated SKILL.md

---
name: my-skill
description: 
category: engineering
license: MIT
version: 0.1.0
agents: [claude-code]
---

## Overview

What problem does this skill solve, and when should the agent reach for it?

## Inputs / outputs

- Input: what the skill consumes
- Output: what it leaves behind (files, commands, results)

## Workflow

1. First step
2. Next step
3. Final check

## Limitations

Anything an operator should know before installing.

name is required
description is required

How the audit score is computed

Base score 70. License +6, version +4, bounded tools +6, no curl-pipe-bash +5, no rm-rf-root +5, no high-entropy strings +4. ≥90 verified · ≥75 community · ≥50 unverified · else flagged.

信任分 = 70（基础分）
   + 6   # 声明了 license
   + 4   # 声明了 version
   + 6   # allowed-tools 范围明确
   + 5   # 安装命令不使用 curl … | bash
   + 5   # 不使用 rm -rf /
   + 4   # 全树 gitleaks 熵阈值 < 3.8

判定阈值
   ≥ 90 → 已审计 (verified)
   ≥ 75 → 社区   (community)
   ≥ 50 → 未审计 (unverified)
   else → 风险   (flagged)

Pre-flight checklist

description ≤ 140 chars; states triggers, not features
license declared (MIT / Apache-2.0 recommended)
version declared and bumped on release
allowed-tools limited to what you actually use
install command never uses curl … | bash
no rm -rf / or equivalent recursive deletes
no real secrets in README / SKILL.md (gitleaks zero hits)

Frequently asked

Do I have to publish on npm to be listed?: No. We mirror SKILL.md from any public GitHub repo. The install command is a placeholder until each agent ships an official registry.
How do I get a "Verified" badge?: Pass every gate of the audit checklist (license, version, no shell-pipe install, no high-entropy literals) and score 90+. The badge attaches automatically — no human review queue.
How often is the index refreshed?: On every push to main and at most every six hours from the scheduled build. Updates from upstream repos appear within one build cycle.