SkillHub Publishing Guide

The problem

Publishing a local skill to skillhub.cn often fails for reasons beyond a single CLI mistake. On Windows, authentication may keep returning 401, while flag names and registry behavior differ between tooling. If a public package also contains a real API Key, local paths, or an outdated version, it can break installation and expose credentials. This skill turns a Windows/WSL publishing run into a repeatable checklist.

How it works

The workflow is built around separating publish packages from runtime packages: the publish package keeps only SKILL.md, templated notes, and placeholders; the runtime package holds real secrets, local paths, and credential-reading logic. Key steps include:
- using the WSL script-based CLI to avoid Windows-native CLI differences in authentication flags;
- reading the SkillHub Token from credential-vault at runtime instead of embedding it;
- converting local paths such as D:\ to /mnt/d/... before publishing;
- checking code, SKILL.md, and README.md for missing hardcoded keys, default credentials, or real paths;
- bumping version when a conflict occurs, then verifying the result through the page or registry.

Boundaries

It assumes the skill directory, Token, and CLI environment already exist, and it does not generate business logic for the skill. Tokens are usually shown only once, so expired or leaked credentials should be recreated. Published versions are hard to fully retract, which makes pre-publish cleanup more reliable than post-release repair.