Skills sharing-skills

📦

sharing-skills

Name: sharing-skills
Author: DYAI2025

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Share Skills Through Pull Requests

Reusable skills often stay local because contributors lack a clear publishing workflow. This skill gives Claude, Codex, and Claude Code a structured process for preparing a branch, commit, push, and pull request.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "sharing-skills" from https://skillstore.io/skills/dyai2025-sharing-skills.md and its manifest at https://skillstore.io/api/skills/dyai2025-sharing-skills/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dyai2025-sharing-skills.md Signed manifest GET /api/skills/dyai2025-sharing-skills/manifest Signed lockfile GET /api/skills/dyai2025-sharing-skills/lockfile

Test it

Using "sharing-skills". I have a tested skill and want to share it upstream.

Expected outcome:

Confirms the skill is broad enough to share.
Checks that the local main branch is synced.
Suggests a feature branch name and commit message.
Drafts pull request text for review.

Using "sharing-skills". My pull request has merge conflicts after upstream changed.

Expected outcome:

Explains how to fetch the latest upstream branch.
Recommends resolving conflicts locally.
Warns before any force push and suggests safer remote update practices.

Security Audit

Medium Risk

v10 • 7/9/2026 Open versioned report

The skill is primarily a documentation workflow for contributing skills through git and GitHub. Most hidden-path and URL alerts are benign setup references, but several examples contain real external commands that can push branches, create pull requests, or use shell interpolation. The packaged ZIP also remains a manual-review blind spot.

Files scanned

195

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:177-179

Force Push Troubleshooting Guidance

The troubleshooting section recommends `git push -f origin your-branch` after rebasing. Force pushing can overwrite remote branch history if used on the wrong branch or without coordination.

The command is explicitly present in troubleshooting guidance. It is legitimate for a personal feature branch but risky enough to require safer wording and confirmation.

Capability review items (23)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:38-43

Ruby/shell backtick execution

```bash

This fenced example contains git or gh commands that can modify branches, push to remotes, or create pull requests if copied and run. The workflow is legitimate, but it performs external operations and should require user confirmation.

Medium

SKILL.md:43-47

Ruby/shell backtick execution

```

Medium

SKILL.md:47-51

Ruby/shell backtick execution

```bash

Medium

SKILL.md:51-55

Ruby/shell backtick execution

```

Medium

SKILL.md:55-59

Ruby/shell backtick execution

```bash

Medium

SKILL.md:59-63

Ruby/shell backtick execution

```

Medium

SKILL.md:63-74

Ruby/shell backtick execution

```bash

The documented commit and PR commands use shell command substitution and interpolated skill names. The examples are legitimate, but copying them with untrusted skill names could create command-injection or malformed shell behavior.

Medium

SKILL.md:74-78

Ruby/shell backtick execution

```

Medium

SKILL.md:78-80

Ruby/shell backtick execution

```bash

Medium

SKILL.md:80-84

Ruby/shell backtick execution

```

Medium

SKILL.md:84-100

Ruby/shell backtick execution

```bash

Medium

SKILL.md:100-106

Ruby/shell backtick execution

```

Medium

SKILL.md:106-142

Ruby/shell backtick execution

```bash

Medium

SKILL.md:142-149

Ruby/shell backtick execution

```

Medium

SKILL.md:149-154

Ruby/shell backtick execution

```bash

Medium

SKILL.md:154-157

Ruby/shell backtick execution

```

Medium

SKILL.md:157-160

Ruby/shell backtick execution

```bash

Medium

SKILL.md:160-166

Ruby/shell backtick execution

```

Medium

SKILL.md:177-179

Ruby/shell backtick execution

- Rebase on latest upstream: `git fetch upstream && git rebase upstream/main`

Medium

SKILL.md:68-73

Shell command substitution

$(cat <<'EOF'

Medium

SKILL.md:89-94

Shell command substitution

--body "$(cat <<'EOF'

Medium

SKILL.md:63-74

Template literal with command substitution

```bash

Medium

SKILL.md:84-100

Template literal with command substitution

```bash

Risk Factors

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dyai2025-sharing-skills/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dyai2025-sharing-skills/security.svg)](https://skillstore.io/skills/dyai2025-sharing-skills?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dyai2025-sharing-skills?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dyai2025-sharing-skills/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dyai2025-sharing-skills.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

DYAI2025. (2026). sharing-skills security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dyai2025-sharing-skills/audits/10

BibTeX citation

@techreport{dyai2025-dyai2025-sharing-skills-2026,
  author = {DYAI2025},
  title = {sharing-skills security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/dyai2025-sharing-skills/audits/10},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sharing-skills security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
  - name: "DYAI2025"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/dyai2025-sharing-skills/audits/10"
identifiers:
  - type: other
    value: "skillstore:dyai2025-sharing-skills:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Publish a reusable local skill

Turn a tested local skill into a clean branch and pull request for upstream review.

Standardize skill contributions

Give team members a consistent checklist for preparing one skill per pull request.

Troubleshoot contribution setup

Identify missing GitHub CLI authentication, SSH configuration, or merge conflict steps.

Try These Prompts

Prepare my skill for sharing

Use the sharing-skills process to help me prepare my local skill for an upstream pull request. Ask before running any git or gh command.

Create a safe contribution checklist

Review my skill contribution plan and produce a step-by-step checklist. Include validation, testing, branch creation, commit, push, and PR creation steps.

Draft pull request content

Help me draft the pull request title, summary, testing notes, and context for a new reusable skill contribution.

Resolve contribution workflow issues

Use the sharing-skills troubleshooting guidance to diagnose my failed contribution workflow. Recommend safe commands and ask before remote changes.

Best Practices

Review every git and gh command before running it, especially commands that push to a remote.
Keep one skill per branch and one skill per pull request for easier review.
Test the skill with realistic prompts before creating the pull request.

Avoid

Do not batch unrelated skills into one pull request.
Do not share project-specific, sensitive, or unstable skills upstream.
Do not force push without verifying the target branch and remote.

Frequently Asked Questions

What does this skill help me do?

It guides you through sharing a reusable skill with an upstream repository through a GitHub pull request.

Does it create the pull request automatically?

It provides commands and structure, but users should review and approve any command that changes git or GitHub state.

What tools does it assume are available?

It assumes git and the GitHub CLI are installed, configured, and authenticated.

Can I use it for private company skills?

Only if the skill is approved for sharing. The source guidance says to keep sensitive or organization-specific skills private.

Why should each skill have its own pull request?

Separate pull requests make review, iteration, and merging easier for maintainers.

Is the skill safe to install automatically?

It contains external command examples and an unscanned archive, so automated installers should treat it with caution.

Developer Details

Author

DYAI2025

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/DYAI2025/Stoppclock-page/tree/main/stoppclock_speckit/.claude/commands/skills/sharing-skills

Ref

1ffa7643651792ccb4bd3b15d924d2c97edff755

Maintenance freshness

7/18/2026

Usage

2 downloads · 185 views

File structure

📄 SKILL.md

📄 SKILL.zip