v1.0.1 — Trusted publishing and re-runnable releases

Release pipeline

• Publishing now uses npm trusted publishing (OIDC). There is no NPM_TOKEN secret: the workflow's id-token: write permission is the whole credential, and provenance is still signed at publish time.
• The release job is re-runnable. A version already on the registry is treated as this release having got that far, and the GitHub release step attaches assets to an existing release instead of failing on it. A run that dies after publishing can now be re-run to completion.
• actions/setup-node 5 → 7 and actions/attest-build-provenance 2 → 4, clearing the deprecated always-auth config and the Node 20 runtime warning.

Packaging

• bin.skillsmithy is now scripts/cli.mjs rather than ./scripts/cli.mjs. npm normalized the path anyway, so the installed binary is unchanged; this only silences a misleading "was invalid and removed" warning at publish time.

Documentation

• README documents the trusted-publishing release path.
• Install and verify commands no longer pin a version, using @latest and a <tag> placeholder, so they stay correct across releases.

v1.0.0 — First stable release

Highlights

Skill Smithy is an agent-first project generator for creating polished, publishable Agent Skills and packaging them for Claude Code, Codex, OpenClaw, and Hermes Agent from one canonical source.

This is the first stable release. The destination contract, config schema, and command surface are now covered by semantic versioning.

Two paths

• Mint: The agent interviews you, creates an independent project outside this checkout, and authors one canonical skill under skills/<name>/.
• Import: Brings an existing skill into a new project byte for byte. No frontmatter normalization, no reformatting, no silent fixes. Only a lowercase skill.md is mapped to canonical SKILL.md.

Either way the Skill Smithy checkout stays pristine and reusable.

What a destination gets

Generated discovery copies and marketplace manifests for Claude and Codex, built deterministically by npm run build from the canonical skill. Tooling arrives as an exact @neefactory/skillsmithy development dependency rather than copied scripts, so upgrades are a version bump instead of a re-scaffold.

build, validate, check, doctor, migrate, and add-skill are exposed as npm scripts. npm run check byte-compares generated output without touching the working tree.

Upgrades that respect your edits

.skillsmithy/provenance.json and baseline copies let migration compare three states: recorded baseline, your current file, and the newer package's desired file. Unchanged managed files are replaced, local customizations are preserved, and overlapping changes stop as explicit conflicts. Canonical skills/** bytes are never migration targets. npm run migrate -- --dry-run writes nothing.

Publishing

ClawHub publishing via CLI, one-time web GitHub import, manually dispatched GitHub Actions, or automatic publishing from a named branch. Runtime requirements are declared under metadata.openclaw and checked against the skill's actual files.

Skills default to MIT-0, with a split shape available when the project itself carries an attribution licence.

Verifying this release

skillsmithy.zip is built by CI from the tagged commit with git archive and carries a signed provenance attestation:

gh attestation verify skillsmithy.zip --repo neefactory/skillsmithy

Also on npm

npm exec --package=@neefactory/skillsmithy@1.0.0 -- \
  skillsmithy mint my-new-skill --out-dir ../my-new-skill

Requires Node >= 22.8. Tested on Windows and Ubuntu.