An essential validation and auditing tool that checks your AI agent skill directory for metadata mismatches, structure issues, and leaked secrets before publishing to ClawHub.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install publish-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install publish-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Publish Audit?
The Publish Audit skill (publish-audit) is a local, privacy-first auditing utility designed to analyze your Openclaw agent skill package prior to release. Publishing a new skill on ClawHub triggers automated validation scans; any configuration discrepancy or undeclared environment variable will result in your release being immediately hidden or rejected. This skill solves that friction by running a local audit and delivering a definitive verdict.
By parsing your local SKILL.md and codebase, this skill simulates ClawHub's structural checks, secret scanning rules, and frontmatter validation logic. It functions entirely without network calls or external credential requirements, providing a clean feedback loop for developers looking to optimize their workflow and build robust Openclaw Skills.
Publish Audit Use Cases
- Pre-Publishing Validation: Run a comprehensive audit on your skill folder before execution of the
clawhub skill publishcommand to ensure first-time approval. - Frontmatter Mismatch Detection: Identify when your code utilizes an environment variable or binary dependency that has not been formally declared in the frontmatter metadata.
- Secret Leak Prevention: Automatically check code files for hardcoded API keys, passwords, or configuration details before they are published to public registries.
- Trigger & Description Optimization: Evaluate whether your skill instructions and trigger boundaries are concrete enough for agent orchestration without causing adjacent system interference.
How Publish Audit Works
- Targeting the Directory: Point the Publish Audit tool at a specific local directory containing a SKILL.md file.
- Structural Evaluation: The tool checks file types (text-only constraints), file sizes (must be under 50 MB), and slug formatting matching the target regex.
- Frontmatter & Code Reconciliation: It reads the YAML frontmatter at the top of SKILL.md and parses all codebase files to match declared parameters (
requires.env,requires.bins) with actual usage. - Instruction & Trigger Analysis: The tool inspects your descriptions for quality indicators, such as clear trigger boundaries and negative conditions ("do not use for...").
- Report & Verdict Generation: It outputs a clean, itemized CLI report detailing passed checks, warnings, and critical blockers alongside a binary READY or FIX FIRST verdict.
Publish Audit Setup
Configure and run the Publish Audit tool directly within your development environment. This utility runs entirely offline with no dependencies on external APIs.
To audit your local skill directory, point the auditor to your active folder containing the target metadata file:
# Run the publish-audit skill pointing to your skill directory
openclaw run publish-audit --dir ./my-custom-skill
Ensure that you have structured your SKILL.md with standard YAML frontmatter before running the command.
Publish Audit Data Schema & Taxonomy
The Publish Audit utility evaluates your skill package based on strict metadata schemas. It focuses heavily on validating the following structural components:
| Directory Element | Valid Pattern / Criteria | Action on Failure |
|---|---|---|
SKILL.md |
YAML Frontmatter included at root | Blocker (rejection) |
| Skill Slug | ^[a-z0-9][a-z0-9-]*$ |
Blocker (malformed URL) |
| Bundle Size | Under 50 MB (Text-based files only) | Blocker (payload too large) |
| Environment Variables | All referenced env vars declared in requires.env or envVars |
Blocker (missing declaration) |
| Binary Dependencies | Declared under requires.bins or requires.anyBins |
Warning (potential missing dependency) |
| License Metadata | MIT-0 without conflicting per-skill overrides | Blocker (license mismatch) |
| Pricing | Free-only; no paid attributes | Warning (strip paid attributes) |
All verified attributes are logged in a clean CLI output without any remote transmission of sensitive content.
Publish Audit Advanced Features
- Zero-Network Policy: Performs deep local static analysis of your skill folder to prevent configuration leaks without any network calls.
- Phantom Dependency Detection: Flags environment variables or binary requirements that are declared in your frontmatter but never actually used in your code, keeping your Openclaw Skills lean.
- Trigger Boundary Validation: Analyzes instructions to ensure they provide clear negative triggers ("DO NOT invoke for adjacent tasks"), preventing rogue agent behaviors.
- Release Commands Generation: On successful verification, automatically provides the exact publish command formatted with the validated slug, name, and version.
SKILL.md
Loading
Related Openclaw Skills
Yorkshire Puppy Care
An AI-powered health and care assistant designed specifically to automate schedules, track health milestones, and analyze behaviors for Yorkshire Terrier puppies.
Backup Tool
A robust and secure utility to backup and restore OpenClaw configurations, skills, memory, identities, and credentials in a single command.
Deep Planning
Deep Planning is a high-latency System 2 planning protocol for AI agents that abstracts complex system-design problems, interrogates them via a blank-context domain-shifting subagent, and outputs a metaphor-washed, self-contained execution blueprint.
Health Monitor
Health Monitor is an automated resource tracking and self-healing system tool designed to keep low-resource environments running smoothly.
Travel Assistant
A proactive, AI-driven personal travel planning consultant that automates itineraries, packing checklists, weather forecasts, and destination preparation.
clean-log-toolkit
A lightweight, zero-dependency Python toolkit designed for local log file parsing, error aggregation, log-aware filtering, and live stream following.
Featured*
