Never-Publish a Skill

How the public mirror works (30 seconds)

• ~/.agents is the private repo <owner>/private-skills. A GitHub Action (.github/workflows/public-mirror.yml) publishes a sanitized mirror to the public repo davidondrej/skills.
• It runs on every push to main, every 6 hours (cron), and on manual dispatch. Fully autonomous — no human gates.
• Pipeline: deterministic excludes/rewrites → AI editor pass → AI reviewer pass → deny-regex scan → publish. Unsure files get omitted (fail-closed).
• tools/public_mirror/mirror.py drops any skill listed in neverPublishSkills (in ~/.agents/public-mirror-policy.json) before all other steps. This is the only hard, deterministic guarantee a skill never goes public. The AI passes are for sanitizing skills that DO publish.
• excludePaths in the same policy handles non-skill paths (tools/**, AGENTS.md, etc.) — not what you want for skills. Skills go in neverPublishSkills by name.

Add a skill to the never-publish list

All edits happen in ~/.agents/public-mirror-policy.json:

1. Add the skill's folder name to the neverPublishSkills array:

"neverPublishSkills": ["youtube-polls", "copywriting", "synology-nas", "composio-cli", "todoist", "<new-skill>"],