Install
$ agentstack add skill-batteryshark-skill-tap-github-publish ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
GitHub publish
Publish the intended project without leaking local state, staging unrelated work, or guessing repository policy.
Prerequisites
Require local git and GitHub CLI gh. Run gh and networked Git commands with host access when the sandbox cannot reach the system keychain, DNS, or GitHub. Never diagnose credentials as invalid from a sandbox-only failure; recheck gh auth status with host access.
Before creating a remote, establish the owner, repository name, and visibility from the request. Visibility changes are consequential; do not infer public, private, or internal when the choice is not already clear.
Workflow
- Run
bin/github-publishfor a read-only local preflight. - Inspect
git status, existing history, branches, remotes, configured identity, ignore rules, README, license, generated output, suspected secret-bearing files, and large artifacts. - Read [
references/repository-checklist.md](references/repository-checklist.md). Fix only repository setup that belongs to the requested publication. - Build
.gitignorefrom actual project evidence. Use [references/ignore-guidance.md](references/ignore-guidance.md); keep lockfiles, fixtures, editor settings, and generated sources when they are intentionally part of the project. - Run the project's relevant checks and execute documented quickstart commands when practical.
- Stage only intended files. Review the staged diff and run
git diff --cached --checkbefore committing. - For a new remote, use the current
gh repo create --helpflags and the confirmed visibility. For an existing remote, verify its owner, target branch, and divergence before pushing. - Push with tracking when needed, apply a concise description and a small set of accurate topics, then verify the remote branch and CI result.
Safety
- Do not overwrite an existing remote, force-push, rewrite history, or change visibility without explicit authorization.
- Do not silently change Git identity or add attribution trailers.
- Do not stage the entire worktree when unrelated changes are present.
- Do not print suspected secret values while scanning or reporting.
- Treat repository creation, pushes, releases, issue creation, and metadata changes as external writes within the user's requested scope.
Report
State repository URL, visibility, branch, commit, checks, CI result, metadata changes, and anything still requiring owner input.
Use [agents/reviewer.md](agents/reviewer.md) for an independent publication preflight.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: batteryshark
- Source: batteryshark/skill-tap
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.