fluxly Search skills… ⌘K 中文 Sign in Publish

Publish a skill

Open a pull request — the audit pipeline does the rest.

Fill the fields below and write the body — that is enough to ship a skill here. Submitting queues it for the next ingest cycle; prefer a GitHub PR? Download the generated SKILL.md from the right column.

Not signed in; editing and downloads still work. Sign in to associate your account identity. Sign in

Write a skill right here

Fill the form on the left, watch the generated SKILL.md on the right. Submit sends it to our ingest queue; if the API is not enabled yet we fall back to a local download so you can open a PR manually.

name (kebab-case)description (≤ 140 chars)0/140

categorylicenseversion

compatible agents

tags (comma-separated)body (markdown)contact email (optional)

Generated SKILL.md

---
name: my-skill
description: 
category: engineering
license: MIT
version: 0.1.0
agents: [claude-code]
---

## Overview

What problem does this skill solve, and when should the agent reach for it?

## Inputs / outputs

- Input: what the skill consumes
- Output: what it leaves behind (files, commands, results)

## Workflow

1. First step
2. Next step
3. Final check

## Limitations

Anything an operator should know before installing.

name is required
description is required

How the audit score is computed

Base score 70. License +6, version +4, bounded tools +6, no curl-pipe-bash +5, no rm-rf-root +5, no high-entropy strings +4. Static-only results are ≥75 community · ≥50 unverified · else flagged. Verified requires explicit manual review or runtime-tested isolated verification.

信任分 = 70（基础分）
   + 6   # 声明了 license
   + 4   # 声明了 version
   + 6   # allowed-tools 范围明确
   + 5   # 安装命令不使用 curl … | bash
   + 5   # 不使用 rm -rf /
   + 4   # 全树 gitleaks 熵阈值 < 3.8

判定阈值
   ≥ 75 → 社区   (community)
   ≥ 50 → 未审计 (unverified)
   else → 风险   (flagged)

注意：纯静态扫描不会产生 verified。只有明确的人工审查，或真正执行过的隔离运行时验证，才允许标记 verified。

Pre-flight checklist

description ≤ 140 chars; states triggers, not features
license declared (MIT / Apache-2.0 recommended)
version declared and bumped on release
allowed-tools limited to what you actually use
install command never uses curl … | bash
no rm -rf / or equivalent recursive deletes
no real secrets in README / SKILL.md (gitleaks zero hits)

Frequently asked

Do I have to publish on npm to be listed?: No. We mirror SKILL.md from any public GitHub repo and use the public skills CLI for verified install targets.
How do I get a "Verified" badge?: A static score never grants Verified automatically. Verified is reserved for an explicit manual review or an isolated runtime verification that was actually executed and recorded.
How often is the index refreshed?: On every push to main and at most every six hours from the scheduled build. Updates from upstream repos appear within one build cycle.