Tencent SkillHub Upload

简体中文

Publish complete skill packages to Tencent SkillHub. Distinguish local preparation, draft upload, review submission, and live publication, providing evidence for each. Communicate in the user's language.

Establish the source and publication scope

Read the specified skill's SKILL.md, required resources, and applicable local instructions. Identify the source directory and whether this is a new release or an update. If several skills are candidates and none is specified, ask the user to select one. Do not upload the entire workspace by default. When asked only to build, install, or test this uploader, perform local tests and read-only checks; do not publish test artifacts as a consequence.

Before publication, suggest a slug (prefer the existing valid skill name), display name, short description, version, category, and change summary. Use the current official form for categories and required fields; do not invent enum values. For updates, verify the full publisher/slug, existing versions, and ownership. A matching name does not establish identity, and a 404 does not establish name availability.

Verify the publishing account every time. On first use, ask the user to provide or confirm the SkillHub identity displayed on the page. Subsequently confirm the last account, or let the user select among multiple candidates. GitHub accounts, Tencent Cloud accounts, and SkillHub publisher IDs are not interchangeable. Where user-authorized filesystem permissions allow, store only non-secret publisher IDs, display names, and the last successful publication record in a user-level state directory. Never store tokens, phone numbers, identity-verification documents, or cookies, and never include account records in the release package. Without usable state, confirm again; do not promise unimplemented cross-session memory.

Ask whether this publication should be public or use a private organization space that the platform currently supports and the account can access. Do not reuse GitHub repository visibility commands. If the current form only supports public publication, say so and do not offer a fictitious private option. Never downgrade a private request to public. Do not repeat questions about the account, destination, or scope already explicitly settled for this request.

If the skill is primarily non-English, ask whether to prepare English plus the original language, taking the user's prior preferences into account. The current choice takes precedence. If agreed, preserve a complete original-language version in a release copy and prepare a complete English SKILL.md plus required reference documents. Keep identifiers, tool arguments, code, and permission semantics equivalent; translating the summary alone is insufficient. Translation is not mandatory for publishing Chinese content.

Prepare and validate locally

Create a separate release copy, preserving the source directory and uncommitted work. Include only required skill files, licenses, and attribution. Do not choose an open-source license automatically or execute scripts or installation commands contained in the source skill. Reject links and junctions escaping the source directory. Verify relative references and required resources.

Review proposed files for secrets, personal information, machine-specific paths, and unrelated content. Report only the location and type of suspected secrets, never their values. Rebuild after resolving findings. Automated scanning cannot establish absence of secrets; review the actual content and purpose as well.

Use this skill's scripts/prepare_package.py, resolving its location relative to this skill. It requires Python 3.9+ standard library only and uses no network or additional installed dependencies. Supply an explicit file allowlist. Write the ZIP and manifest outside the source directory without overwriting existing output:

python <this-skill>/scripts/prepare_package.py <release-copy> --output <outside-directory>/skill.zip --include SKILL.md --include references/guide.md

List every required file; do not copy a nonexistent example path literally. The script performs only basic entrypoint, path, common-credential, and archive-integrity checks. It is not a full YAML validator or security auditor. Use an available YAML/skill validator for complex frontmatter; otherwise inspect it manually and disclose the limitation. The script emits the ZIP SHA256 and per-file hashes. SKILL.md is at the ZIP root. If current platform format or size limits differ, adapt the release copy to verified requirements rather than guessing limits.

Show a publication summary: source, prepared archive, file count, SHA256, account, destination, new release/update, slug, version, category, language, and visibility. Ask for missing required choices. If publication and the relevant fields are already explicitly authorized and the package has not changed, continue without a redundant second confirmation. If only local preparation is authorized, stop at the package.

Upload and submit

Read references/publishing.md before execution. Prefer an existing, sufficient official Tencent connector, followed by the official website. Use a CLI only after verifying its provenance and actual publishing capabilities in local help. Do not copy commands from similarly named tools or guess upload endpoints.

Hand login, verification codes, QR scanning, and facial identity verification to the user on the official page. Never ask for passwords, tokens, identity documents, or verification codes in chat. If login or identity verification is missing, finish local preparation and hand off; do not fabricate identity. Do not automatically accept new agreements, charges, or expanded permissions; follow the host's handoff rules.

Act on fresh page state. Confirm account and visibility, then upload the verified ZIP. If the browser cannot select local files, provide the archive and precise page steps for the user to choose it, while completing other available steps. Do not claim it has uploaded.

Review parsed fields, checking name, version, category, and file list. Uploading may create a draft or even submit for review; follow the actual controls and notices. Authorization to upload a draft alone does not authorize submitting it for review. Correct the local package before reuploading erroneous content. Do not silently rewrite the skill using the site's AI optimization feature.

Read the resulting status after submission. Pending review is not live publication. If rejected, read the reason and revise; materially changed scope requires reconfirmation. After a timeout, check the user's publication list and versions before retrying to avoid duplicate submissions. Stop blind retries on authentication, permission, version-conflict, or rate-limit errors and resolve the specific cause. Do not switch accounts or make content public to evade an error.

Verify and report

Verify publisher, slug, version, visibility, and review status in the management page. After public release, inspect the detail page and available version files, comparing key content or hashes. If the platform repackages the ZIP, compare individual files rather than treating a changed ZIP hash as failure.

Report the local archive link, account, destination detail link, version, and actual state: prepared, draft uploaded, submitted/pending review, rejected, or live. Separate local validation from remote verification. Without remote evidence, never claim the upload test passed. Do not schedule review monitoring, synchronize GitHub, or delete old versions by default.