version: "1.0.0" name: private-skill-sharing-review description: "Review a proposed sharing or publishing workflow for a private AI skill using supplied repository visibility and authorization details. Identify intended recipients and missing access evidence before suggesting a sharing path." metadata: version: "1.0.0" target-agents:

• claude-code
• codex

Private skill sharing review

Use the supplied repository visibility, intended audience, distribution destination and authorization. Keep local installation, private team distribution and public indexing separate.

For private source, preserve its existing audience unless the owner explicitly authorized a wider audience for the exact content. A successful authenticated local install does not authorize publication, and a paid plan does not change repository visibility or prove that a hosted private registry works.

Review the proposed destination's actual access controls. If supplied information lacks tenant membership enforcement, private storage boundaries or private install credentials, mark those as unknown rather than asserting enterprise readiness. Do not include access tokens, private source text or credentials in public examples, URLs, logs or reports.

Recommend the narrowest path matching the requested audience: an authenticated repository install for a specified local machine; a verified private registry for named team members; or public publication only with explicit content-specific authorization. When publication is authorized, identify the exact content and destination and retain a result receipt; do not silently substitute a public service for a failed private destination.

This skill reviews the plan. It does not itself authorize publishing, membership changes, billing changes or messages.