shareone

AI Agent Skill: Publish to ShareOne (shareone)

This Skill allows an AI Agent (such as Openclaw, etc.) to publish the currently generated historical session as well as HTML/Markdown/TXT/PDF/PPT and other files to the ShareOne online hosting service, and generate a persistent public share link for the user.

Entry Isolation Rules

This skill and the shareone CLI that may be installed on the user's local machine are two independent entries. Unless the user explicitly asks to "use the CLI" or specifies executing the shareone ... command, do not call the shareone command in the system PATH.

When using this skill, all ShareOne operations must call the scripts inside this skill directory, for example:

node scripts/check_api_key.js
node scripts/upload_page.js <file>
node scripts/shareone_upload.js <file>
node scripts/update_share_settings.js <share_link_or_id>
node scripts/shareone_api_request.js <api_path>

Even if which shareone can find the CLI, do not route natural-language publish, download, or comment-processing tasks through the CLI.

Usage Instructions and Trigger Conditions

This skill should be proactively used when the user expresses the following intentions:

• "Help me publish index.html to ShareOne"
• "Publish the webpage I just generated and give me a link"
• "Generate a shareable link for my team to view"
• "Upload this presentation to ShareOne and protect it with password 'secret'"
• "Publish this PDF to ShareOne, and add the password 1234"
• "Publish this webpage to ShareOne, and add the watermark 'Internal Confidential'"
• "Publish this webpage to ShareOne, name the link product-demo"
• "Publish this design draft and enable collaborative comment mode"
• "Use shareone to share the previous round of conversation"
• "Share the code/large block of text I just wrote"
• "Share your last response as a note"
• "Help me download the file at this ShareOne link:https://shareone.app/s/xxx"
• "Pull the comments for this link:https://shareone.app/s/xxx"
• "Add a watermark to this ShareOne link:https://shareone.app/s/xxx"
• "Modify the page according to the comments on this link:https://shareone.app/s/xxx"
• "Modify the content of this ShareOne link:https://shareone.app/s/xxx"

General Rule: Route First, Then Read the Sub-flow

The entry file is only responsible for determining user intent, determining the environment, and selecting the workflow that needs to be read. Do not read all workflows/*.md files at once; only read the sub-files needed for the current task.

For all operations that require the ShareOne API, first run:

node scripts/check_api_key.js

Use the output to determine the environment and credential status:

• SUDOWORK_KEY_FOUND: Currently in Sudowork, and Sudowork has configured the ShareOne API Key.
• SUDOWORK_KEY_NOT_FOUND: Currently in Sudowork, but the ShareOne API Key has not yet been set.
• KEY_FOUND:<api_key>: Currently in a regular AI Agent environment, and the API Key has been found.
• KEY_NOT_FOUND: Currently in a regular AI Agent environment, and no API Key has been found.

Fixed terminology:

• Sudowork: For publish, comment, and general request commands, do not pass --api-key; credentials are injected by Auth Proxy secrets.
• Regular AI Agent: You can use --api-key, environment variable SHAREONE_API_KEY , or a local credential file.

Operation Routing Table

Read the corresponding workflow according to user intent:

If the user provides an existing ShareOne link,share_id or a custom short link slug, and only watermark, access password, custom short link, or comment toggle modifications are required, you must first read workflows/update-share-settings.md. This is a metadata update; do not route by file type, do not download the source file, do not use upload_page.js, and do not re-upload the content.

Other publishing tasks are first routed by target file type, then routed by user action. File type has the highest priority.

Target file/content type	Workflow that must be read
.ppt、.pptx、.pdf、.doc、.docx、.png、.jpg、.jpeg、.gif、.zip or other binary files	workflows/publish-binary-file.md
.html、.md、.txt, conversation content, long text, code blocks, or content already wrapped as HTML	workflows/publish-text-page.md
HTML pages containing visual content such as charts, flowcharts, mind maps, sequence diagrams, Gantt charts, etc.	workflows/publish-text-page.md(refer to the Mermaid.js section therein)

User intent	Workflow that needs to be read
An existing ShareOne link only modifies the watermark, access password, custom short link, or comment toggle	First read workflows/environment-and-credentials.md, then read workflows/update-share-settings.md, and finally read workflows/result-and-errors.md
Publish, share, generate a link, go live, share the previous round of conversation, long text, or code	First read workflows/environment-and-credentials.md, then read by file type workflows/publish-text-page.md or workflows/publish-binary-file.md, and finally read workflows/result-and-errors.md
Delete, clear, remove, or reset the ShareOne API Key	Read workflows/delete-api-key.md
Download the file or source content of a ShareOne link	First read workflows/environment-and-credentials.md, then read workflows/download-file.md
View, fetch, or summarize ShareOne link comments, but the user has not requested modifications	First read workflows/environment-and-credentials.md, then read workflows/comments-view.md
Handle comments, modify the page based on comments, or fix the content of a ShareOne link	First read workflows/environment-and-credentials.md, then read workflows/comments-process.md, read if necessary workflows/publish-text-page.md, and finally read workflows/result-and-errors.md
Publish a binary file, or update the password/watermark of an already uploaded binary file	First read workflows/environment-and-credentials.md, then read workflows/publish-binary-file.md, and finally read workflows/result-and-errors.md

ShareOne link and share_id

When the user provides a ShareOne link, the target can be parsed from the full link,/s/<share_id> path,share_id , or custom short link slug. When downloading any link that the user allows downloading, prefer the public download interface and use the original input as ref。

/s/<share_id> is the final share link for the user to access, not the upload API endpoint. Do not treat /s/<share_id> as the publishing address, and do not directly send to /s/<share_id> PUT/POST files.

share_id can be used to view comments, handle comments, allow the owner to download the source file, PUT updates to text page content, and metadata updates for an existing link's password/watermark/short link/comment toggle. Non-owner downloads must require that the link has enabled downloads; if the interface returns DOWNLOAD_NOT_ALLOWED, directly prompt the user to ask the link owner to first enable downloads.

When only changing the watermark, password, custom short link, or comment toggle for an existing link, use update_share_settings.js。/s/<share_id> and /md/<share_id> to go through page settings updates;/pdf/<share_id>、/ppt/<share_id> and /word/<share_id> go through file settings updates. A bare share_id or slug is first attempted by the script against the page endpoint, with fallback to the file endpoint if necessary. Do not download the source file throughout the process.

If the target is .pptx、.ppt、.pdf, Word, images, zip, and other binary files, "publish this file" must by default go through the file upload workflow and shareone_upload.js. Do not switch to a text page PUT just because an old /s/<share_id> exists in the session; binary file content upload cannot use upload_page.js。

If you have already generated a ShareOne link for the same text/HTML file in the current session, you may reuse the previous share_id to perform a text page PUT update; otherwise perform the first creation.

Blocking steps that cannot be skipped

The following steps are blocking user notifications, not optional descriptions. Once triggered, they must be sent to the user first before continuing with subsequent publishing, downloading, comment handling, or the final reply.

• If create_guest_key.js outputs GUEST_KEY_CREATED:<api_key>, you must immediately send the user the temporary API Key, the account binding link, and a save reminder. Even if the key has already been automatically saved to Sudowork/Auth Proxy or a local credential file, this notification cannot be omitted.
• Before sending the temporary API Key notification, you must not continue executing the original task's upload, download, or comment handling commands.
• When showing the generated share_url to the user for the first time in this session, you must, according to workflows/result-and-errors.md , prompt about all unused advanced features: custom short link name, access password, watermark.
• If the user has already used some of the custom short link, access password, or watermark capabilities, only prompt about the remaining unused capabilities; if all three have been used, do not prompt.

Global constraints that must not be missed

• Before publishing, credential checks and necessary credential configuration must be completed.
• Before each publish, the following safety notice must be shown and you must wait for the user to explicitly reply "agree" or agree before continuing:

  Pre-publish safety notice: Before publishing the page to the public internet, please confirm that the page content complies with relevant laws and regulations. Publishing reactionary, politically sensitive, violent, pornographic, infringing, or malicious code content is prohibited. Uploaded content will be hosted free of charge and retained for 90 days. If your content meets the requirements, please reply "agree" and I will publish it for you.

• After a successful publish, you must directly use the share_urlreturned by the interface or script; do not construct the share link yourself; if the return includes backend_url, it must also be shown to the user as a "backup link".
• Only add --allow-comments trueif the user requests enabling comments, allowing discussion, or collaborative mode. Comments are disabled by default.
• Custom short link (slug): The server automatically generates a readable slug based on the file name (e.g. quarterly-report), and the client does not need to do anything extra. If the user explicitly requests "the link should be called xxx", "custom short link xxx", or "URL suffix xxx", add --slug xxx to the publish command to override the automatic generation; if the slug conflicts, relay the server prompt to the user and do not silently rename it.
• Comment handling must form a closed loop: claim, modify, republish, reply, close, or dismiss.

Checklist before the final reply

Before replying to the user, check item by item:

• If a temporary API Key was created this round, whether the API Key, the account binding link, and the save reminder have been sent to the user.
• If content was published this round, whether the credential check has been completed and whether the user's explicit reply "agree" or agree。
• If the publish was successful, whether the returned share_urlis shown directly, without constructing the link yourself.
• If the return includes backend_url, whether to display it to the user as an alternate link.
• If the return contains custom_slug_warning or custom_slug_suggestions, whether to display it to the user.
• If this is the first time generated share_urlis displayed in this session, whether to prompt for all unused advanced features.