AgentStack
SKILL verified MIT Self-run

Publish

skill-neuroanalytics-data-science-harness-publish · by neuroanalytics

>

No reviews yet
0 installs
0 views
view→install

Install

$ agentstack add skill-neuroanalytics-data-science-harness-publish

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access No
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets Used
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README — it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/skill-neuroanalytics-data-science-harness-publish)

Reliability & compatibility

Security review passed
0 installs to date
no reviews yet
3d ago

Declared compatibility

Claude CodeClaude Desktop

Compatibility is declared by the source manifest. End-to-end runtime verification is coming — see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps — measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Publish? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Skill: publish

Make the dataset Distributable (STAMPED-D): transfer already-committed state to a sibling so anyone with access can clone it and retrieve the exact annexed outputs. You never run DataLad yourself — you delegate every sibling/push/verify operation to the datalad doer.

> STAMPED note: a datalad-managed dataset served over any git-annex sibling already satisfies > baseline Distributability — a plain SSH/local sibling is enough. Richer archival targets > (GitHub + a storage sibling via --publish-depends, OSF, a RIA store) are add-ons layered on > the same push, not prerequisites. Pick the lightest target that meets the sharing need.

When to use

  • The user wants to share, back up, release, or hand off the dataset, or make it reproducible for

a collaborator/reviewer.

  • Do NOT use to record local work — that is analyze/checkpoint (a checkpoint should happen

before publishing; publish only ever transfers committed state).

  • Do NOT use to run or promote an analysis — that is the analyze/* skills.

Steps

  1. Ensure a clean, committed tree — delegate to the datalad doer:

> "status: report modified/untracked files and the current branch." Push transfers only committed state. If the tree is dirty, tell the user and route to analyze/checkpoint first (or have them confirm publishing the current committed state).

  1. Choose the target sibling — delegate to the doer:

> "siblings: list configured siblings for this dataset."

  • A suitable sibling already exists → use it.
  • None exists → ask the user where to publish, then delegate creation to the doer. Keep it

to the lightest option that fits (baseline D needs only one of these):

  • local path / SSH host — create-sibling (simplest, satisfies D)
  • GitHub/GitLab/GIN + a storage sibling wired with --publish-depends (so annexed

content reaches storage before git history reaches the host)

  • OSF (create-sibling-osf, needs the datalad-osf extension) or a RIA store — richer

archival add-ons. If a git host is paired with separate annex storage, the storage sibling MUST be set as a --publish-depends — otherwise the push sends git history without the file content and consumers cannot retrieve outputs.

  1. Guard against publishing secrets — before pushing, confirm no credentials, tokens, or

restricted/identifiable data are staged for transfer. De-identification is a separate concern (deferred), but never publish .git-annex-tracked PII or a credentials/.env file. If in doubt, ask the user.

  1. Push — delegate to the doer:

> "push: datalad push --to including annexed content (--data anything, or > auto-if-wanted if the sibling has annex-wanted configured); push all comparison branches, > not just the current one." Wait for the doer's structured result (git refs pushed, annexed objects transferred).

  1. Verify Distributability — delegate a fresh-clone check to the doer (the same proof the e2e

smoke test asserts — see tests/e2e-smoke.sh, "distributability"): > "clone ` to a scratch dir and datalad get one published output; confirm the > content is retrievable, then discard the clone." If retrieval fails, the annexed content did not reach storage — most often a missing --publish-depends`; relay the doer's error and stop.

  1. Log it — append to project.yaml:

{ ts, op: publish, stage: disseminate, note: "pushed to ; verified clone+get", branch: }.

  1. Report — the sibling, what was transferred (git + annex), that an independent clone can

retrieve the outputs, and any richer target the user might add next (OSF/Zenodo DOI, RIA).

Constraints

  • Delegate every sibling/push/clone/get operation to the datalad doer — never call datalad

(and never git push) directly; a raw git push bypasses annex content and publish-depends ordering.

  • Publish only committed state — a dirty tree means checkpoint first; never --force a push over

a sibling's history to "make it fit".

  • Never skip the --publish-depends wiring when a git host and a separate storage sibling are

both in play — this is the single most common cause of "cloned but can't get the data".

  • Do not publish credentials or restricted/identifiable content; surface the risk instead.
  • Keep project.yaml append-only.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Versions

  • v0.1.0 Imported from the upstream source.