Skillweave SDK publish smoke test

Verifies ClawHub publish flows from the TypeScript client with a non-trivial SKILL.md body.

Security Scan

The SKILL.md's runtime instructions match the stated publish-smoke-test purpose, but the registry metadata omits a required CLAWHUB_TOKEN and the instructions suggest loading a local .env (which could expose other secrets) — an inconsistency that should be clarified before use.

Purpose & Capability

The skill's stated purpose (verifying publish flows) aligns with the instructions (calling SkillweaveClient.publishSkill and validating the published artifact). However, the registry metadata declares no required environment variables or credentials while the SKILL.md explicitly requires a CLAWHUB_TOKEN with publish permission. That mismatch is unexpected and disproportionate to the declared metadata.

Instruction Scope

Instructions are narrowly scoped to building SKILL.md content, calling publishSkill, and verifying the result. They also instruct: 'Load secrets from .env' and show use of process.env.CLAWHUB_TOKEN. Loading a .env file is a standard dev convenience but can cause accidental exposure of unrelated secrets if done carelessly; the instructions do not limit which files or keys to read or how to protect them.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so it does not write or download artifacts to disk during installation. That is the lowest-risk install posture.

Credentials

The SKILL.md requires CLAWHUB_TOKEN (a publish-capable token) but the package metadata lists no required environment variables or primary credential. Requesting a publish-scoped token is reasonable for the stated purpose, but the absence of that requirement in the metadata is an incoherence. The .env instruction increases the risk of unintentionally exposing other secrets unless the user follows strict practices. No other unrelated credentials are requested.

Persistence & Privilege

The skill does not request always:true and is not asking to modify other skills or system-wide agent settings. Autonomous invocation is allowed by default and is not combined with other high-risk flags.

What to consider before installing

This skill appears to be a legitimate publish smoke test, but there are two issues to resolve before installing or running it: (1) the SKILL.md requires a CLAWHUB_TOKEN (publish permission) yet the registry metadata does not list that credential — ask the publisher to add requires.env/primary credential metadata so you know what the skill needs; (2) the instructions say to 'Load secrets from .env' — do not commit .env to source control, and prefer providing a least-privilege, ephemeral CLAWHUB_TOKEN from a secrets manager or CI secret store rather than a long-lived token in a local .env. Also verify you are testing against an appropriate namespace/slug (avoid publishing to production accounts) and confirm the workflow will not leak absolute local paths or other unrelated secrets into the published bundle.

Purpose

Use this skill when you need a concrete, repeatable checklist for validating that a Skillweave or ClawHub client can upload a skill bundle, that the server accepts the payload, and that the published artifact contains expected files.

When to apply

• After changing publish request serialization, compression, or multipart boundaries in the SDK.
• When debugging HTTP 4xx responses from the skills API (thin content, missing SKILL.md, invalid semver).
• Before tagging a release that touches publishSkill or ClawHub integration tests.

Preconditions

• Environment variable CLAWHUB_TOKEN is set to a token with publish permission for the target namespace or slug.
• The slug you pass to publishSkill is available or you intend to publish a new semver for an existing slug.
• files includes SKILL.md (or skills.md) with non-trivial documentation, not a one-line placeholder.

Workflow

1. Load secrets from .env without committing tokens to version control.
2. Build a UTF-8 buffer for SKILL.md that includes this frontmatter block and several sections (purpose, workflow, constraints).
3. Call SkillweaveClient.publishSkill with slug, displayName, version, and the file list.
4. On success, log the returned identifiers and confirm the skill appears in the registry UI or list API.
5. On HTTP 400 with a message about thin or templated content, expand SKILL.md with domain-specific steps, examples, and edge cases until the validator accepts the bundle.

Constraints and edge cases

• Version format: Use semantic versioning strings the API accepts (for example 1.0.0, not bare 1).
• Content quality: Automated checks reject boilerplate-only bodies. Prefer real procedures tied to your repository or team.
• File paths: Use forward slashes in relPath entries; avoid absolute paths on the client machine leaking into the archive structure.

Example invocation shape (TypeScript)

const client = new SkillweaveClient({
  clawhub: { apiKey: process.env.CLAWHUB_TOKEN! },
});
await client.publishSkill({
  slug: "my-skill-1",
  displayName: "Skillweave SDK publish smoke test",
  version: "1.0.0",
  files: [{ relPath: "SKILL.md", bytes: new TextEncoder().encode(skillMd) }],
});

Verification

After publish, fetch the skill by slug or open the ClawHub listing and confirm the version, display name, and that SKILL.md renders with headings intact. If integration tests delete skills, run undelete or republish only after confirming slug policy for your account.