punk-redskill-forge

Punk REDSkill Forge

Organize the user-provided Skill into an independent, reviewable REDSkill upload package, and never modify the original Skill. The deliverables are an honestly installable copy, an audit report, and a draft of submission fields, not a promise of "guaranteed approval."

On what the user says

Communicate and output in Chinese by default. The user can simply say:

帮我把这个 Skill 整理成可上传 REDSkill 的版本：
<粘贴链接、文件夹路径或 ZIP 路径>

Do not require the user to use English commands, and do not label the source as a "GitHub Skill." When the source is indeed a GitHub link, the link may be truthfully recorded in the "Source" field of the audit report.

Security boundaries

Never package or help hide the following:

• Account operation capabilities such as automatically publishing notes, commenting, replying, liking, following, or inflating engagement;
• Credentials, cookies, private keys, tokens, API keys, browser data, or data collection whose purpose cannot be explained;
• Illegal services, exaggerated features, prompts that secretly change Agent behavior, or hidden features.

When the above content is found, stop packaging and list it as a "blocking item" in the audit. Do not secretly remove features just to pass the check; instead, explain the problem and require the author to explicitly remove or redesign them. Do not publish to Xiaohongshu on behalf of the user.

Workflow

1. Accept a link, local folder, or ZIP. If multiple SKILL.mdare found, ask the user to choose the Skill to organize; do not automatically merge unrelated Skills. The user providing a path or link only authorizes inspection and copying, not modification of the original or publishing.
2. Read the REDSkill upload specification, and use the Xiaohongshu CLI to verify the current official notices before making compliance judgments. The platform's latest specifications and upload page prompts take precedence.
3. Run the pre-check tool. It will create an independent copy, scan for blocking items, and write out an audit:

node scripts/prepare-redskill.mjs \
  --source "<github-url | local-directory | zip>" \
  --output "<output-directory>" \
  [--skill "<relative-folder-or-SKILL.md>"]

If blocking items exist, the command will exit with a non-zero status and will not generate an upload ZIP; the original Skill will never be modified.

1. Read REDSKILL-AUDIT.md. All blocking items must be resolved through explicit source file changes or removal/refactoring confirmed by the author. Warning items also require a documented judgment; "no rule matched" does not equal absolute safety.
2. Review the copy against the original. Preserve genuine functionality and necessary code/resources, and only rewrite the necessary descriptions, permissions, data usage, source attribution, and user-visible statements. If the selected Skill depends on resources outside the folder, ensure the resources are copied and the paths can be resolved from the ZIP root directory.
3. Read the upload page field mapping, then based on the selected SKILL.md 's actual capabilities, write REDSKILL-SUBMISSION-FIELDS.md and redskill-submission-draft.json. First write the source upload requirements verifiable on the current official page: a folder or ZIP containing SKILL.md , a maximum of 10MB per file, a total size not exceeding 30MB, the original/reposted selection, and the "Skill Publishing Security Specification." Then separately provide suggestions for the display name, English internal ID, introduction, version, source, permissions, and security boundaries. Do not disguise Forge suggestions as fixed page fields; the second step is based on the user's live page.

When it cannot be completed directly

• Multiple Skills: ask the user to select the source subdirectory; do not automatically merge.
• Credentials, account automation, hidden behavior, or violating services: stop and report the blocking item.
• Missing external dependencies or broken paths: do not guess; package dependencies only when licensing/rights and functionality are clear, otherwise ask the author to decide.
• Third-party styles, names, or assets: retain only when rights and attribution are clear; brand presets with unclear reuse rights should be removed first.

Deliverables

For candidate packages with no blocking items, deliver:

• <slug>-redskill.zip：SKILL.md located in the archive root directory;
• REDSKILL-AUDIT.md: inspection results, warnings, sources, and remaining manual review items;
• REDSKILL-SUBMISSION-FIELDS.md: separately record the officially confirmed upload requirements and Forge submission suggestions;
• redskill-submission-draft.json: a structured draft of the same submission suggestions, for easy copying according to the live page;
• the complete extracted copy, for transparent inspection.

According to pre-check result explanation handle the findings.references/redskill-upload.rule.yml is an optional x-cmd rule set for independent qualitative review; before use, first run x rule lint。