Skill marketplaces use different package layouts, submission interfaces, and account requirements. This skill combines release checks, packaging helpers, supported API submissions, and manual publishing guidance.
Review the Skillstore skill "publish-to-all-skill-stores" from https://skillstore.io/skills/xixi048-publish-to-all-skill-stores.md and its manifest at https://skillstore.io/api/skills/xixi048-publish-to-all-skill-stores/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.
エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
Most static findings are harmless detection patterns, Markdown formatting, multilingual text, or expected publishing operations. Confirmed risks include GitHub token disclosure through a third-party mirror and predictable temporary login logs. Additional findings concern unsupported safety assurances, packaging secrets or external symlink targets, and checksum files that do not authenticate the ZIP archive.
Unsupported Safety Assurances Encouraged During Review
SKILL.md says adding safety assertions to submission notes is more effective than changing code. It lists no network and mandatory backups without requiring verification. This can mislead reviewers and downstream agents about the submitted skill's actual behavior.
The guidance explicitly favors assurances over code changes and supplies safety claims without an evidence requirement. No evidence establishes that those claims hold for every submitted skill.
Release Packages Can Include Secrets and External Symlink Targets
The release denylist omits common credential files such as .env, and file symlinks are collected without containment checks. Reading their bytes can package secrets or files outside the selected skill directory for later publication.
The collector accepts any file not matching the denylist, and read_bytes follows file symlinks. No credential exclusion or resolved-path boundary check protects the release archive.
Checksum Sidecar Does Not Authenticate the ZIP Archive
The .zip.sha256 sidecar contains a hash of concatenated source-file bytes, not the ZIP it names. Archive paths and metadata are excluded, so it cannot reliably authenticate the published artifact.
The digest updates only with source contents before writing the archive entries. The sidecar labels that digest with the ZIP filename despite never hashing the completed ZIP.
The command retrieves a GitHub token and encodes it for the authorization header sent to ghfast.top in lines 97-98. This exposes credentials to a third-party mirror.
push https://ghfast.top/https://github.com/<owner>/<repo>.git main
The preceding command attaches a GitHub Basic authorization header to this ghfast.top push. HTTPS terminates at the mirror and does not protect the token from that operator.
The retrieved GitHub token is used in the authorization header for a ghfast.top push in lines 151-154. The complete recipe discloses credentials outside GitHub.
The command encodes the GitHub token for the subsequent third-party mirror request. Base64 is reversible and does not protect the credential from the mirror.
push https://ghfast.top/https://github.com/<owner>/<repo>.git main
The push sends a GitHub token through an explicit authorization header to ghfast.top. A third-party HTTPS mirror can read that header and reuse the credential.
Shell redirection opens a predictable shared temporary filename without exclusive creation or restrictive permissions. Local users can potentially read login codes or precreate a symlink to redirect writes.
Device-login output is redirected to a fixed shared temporary path without exclusive creation or permission controls. Local attackers could expose login codes or redirect the write through a precreated symlink.
The command trusts a predictable shared login log without checking its owner or provenance. A local attacker could substitute authorization instructions, and permissive file creation can expose device codes.
xixi048. (2026). publish-to-all-skill-stores security audit report (audit version 1) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/xixi048-publish-to-all-skill-stores/audits/1
BibTeX形式の引用
@techreport{xixi048-xixi048-publish-to-all-skill-stores-2026,
author = {xixi048},
title = {publish-to-all-skill-stores security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/xixi048-publish-to-all-skill-stores/audits/1},
note = {Author version 1.0.0}
}
CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "publish-to-all-skill-stores security audit report (audit version 1)"
version: "1.0.0"
type: report
authors:
- name: "xixi048"
date-released: "2026-10-25"
url: "https://skillstore.io/skills/xixi048-publish-to-all-skill-stores/audits/1"
identifiers:
- type: other
value: "skillstore:xixi048-publish-to-all-skill-stores:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由証拠の信頼度: 中
68
アーキテクチャ
100
保守性
87
コンテンツ
65
コミュニティ
91
仕様準拠
作成できるもの
Prepare a First Skill Release
Review repository layout, licensing, package contents, and supported submission routes before publishing a new skill.
Coordinate Marketplace Distribution
Prepare approved API submissions and record submitted, failed, login-required, and porting-required channels separately.
Plan Paid Listings
Identify seller onboarding requirements, prepare comparison examples, and distinguish direct distribution from platform-specific redevelopment.
これらのプロンプトを試す
Review Publishing Readiness
Review my skill at <skill-directory> for publishing readiness. Report layout, licensing, and content issues without changing files or contacting stores.
Prepare a Release Package
Inspect <repository> and <skill-subdirectory> for secrets and external symlinks. Propose a package manifest and output directory, then wait for approval before building.
Plan Selected API Submissions
Prepare submissions for <approved-stores> using <repository-url>. Show destinations and disclosed fields first. Do not upload or contact services until I approve.
Coordinate a Multi-Channel Release
Plan distribution for <skill> across <channels>. Separate APIs, contributions, logins, and ports. Require evidence for safety claims. Never send credentials through mirrors.
ベストプラクティス
Confirm repository visibility, target stores, contact disclosures, and publication permissions before sending any submission.
Inspect release contents for secrets and external symlinks, and verify the completed archive with an independent SHA-256 utility.
Use direct service authentication, verify safety statements against code, and retain receipts without treating pending review as approval.
回避
Sending GitHub tokens through third-party mirrors or reusing predictable shared authentication logs.
Submitting uninspected packages or claiming offline operation and backups without supporting evidence.
Treating every channel as automated, repeatedly resubmitting pending releases, or reporting submitted listings as approved.
よくある質問
Does this skill publish to every marketplace automatically?
No. It implements selected API submissions and provides guidance for other channels. Some channels require login, manual review, or a separate port.
Which AI tools can use this skill?
The skill is listed for Claude, Codex, and Claude Code. Its helper scripts require a compatible local Python installation.
What information leaves my computer during submission?
Depending on the channel, submissions send a repository URL, notes, contact details, or the selected skill document. Review these fields before approval.
Can it set prices or complete seller onboarding?
No. It documents pricing preparation, but seller accounts, payment onboarding, and final listing prices require platform-specific actions.
Does a passing preflight prove the skill is secure?
No. Preflight uses limited pattern checks. Inspect behavior and package contents independently, and remove unsafe mirror authentication guidance before use.
Can I distribute a private repository?
Public indexers generally require public access. Private distribution may need authenticated platform import or an approved package upload, depending on the service.