Publish your first skill
Scaffold a skill, validate and scan it locally, then publish an immutable version to a registry.
This walkthrough takes a skill from an empty directory to a published version. Make sure you're signed in first, and that you can publish to the target registry (you'll need the right role — see Organizations & roles).
The walkthrough
Scaffold the skill. Start from a spec-valid skeleton. The new command
validates the name against the skill-spec rules before it writes anything to
disk:
skillhub new tokens-workflow --type general --description "A design tokens helper"Every skill has a type — one of project, general, or meta — recorded
in its SKILL.md frontmatter. The type is required at publish time, so set it
now with --type.
This creates a directory containing a SKILL.md you can flesh out with your
skill's body, scripts, references, and assets.
Validate it. Once you've written the skill, check it against the spec — frontmatter fields, that the name matches the directory, size limits, path safety, and broken relative links:
skillhub validateFix any reported errors before moving on. Warnings won't block a publish, but they're worth reading.
Scan it. Next, run the security scanner. This is the same engine the server runs on publish, so running it locally catches problems before you ever hit the network:
skillhub scanThe scan looks for secrets, prompt-injection, exfiltration patterns, and
dangerous shell, and reports a status of pass, warn, or fail. A blocking
finding exits with code 4 before any upload happens — nothing leaves your
machine until the skill is clean.
Publish. Now publish to a registry you can write to:
skillhub publish --to @studio/design-systemsPublishing runs the full pipeline in order: validate → scan → pack → upload.
On success it creates an immutable, content-hashed semver version and moves a
dist-tag to it. The tag defaults to latest; use --tag beta (or any custom
tag) to publish to a different channel instead.
skillhub publish --to @studio/design-systems --tag betaA single-directory publish is promptless. If you pass several directories at
once, SkillHub confirms each one (the bulk path); add --yes to batch
through them.
A blocking security finding exits with code 4 before any upload happens — nothing leaves your machine until the skill is clean.
What you get
After a successful publish you have a frozen version that will never change, and
a dist-tag pointing at it. Anyone with access to the registry can now install
it. If the registry requires review, your version is published but the
latest tag is held for an admin to promote — see
Review-required registries for how that flow
works.
What's next
- Learn how versions and dist-tags resolve.
- See how consumers install a skill.