Skip to content
Back to skills

References

ASecurity

> **Prerequisite:** Follow the Global AE CLI Rules in [`../SKILL.md`](../SKILL.md). Domain: **Skills / write**

  • 45 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 23, 2026
toolsgobashapi

Works with

  • cli
  • api

Security analysis

A100/100

Pro scans all 21 files and shows the line behind each finding

Scanned September 23, 2026

npx -y skills add ahang1598/doubao-workbuddy-qwenwork-skills --skill references --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of References?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for References
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/ahang1598-references-252a5494/badge)](https://www.skillsdirectory.com/skills/ahang1598-references-252a5494)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
# agent +upload-skill (Upload ZIP Skill)

> **Prerequisite:** Follow the Global AE CLI Rules in [`../SKILL.md`](../SKILL.md).

Domain: **Skills / write**

## Use Cases

- Upload a ZIP-format Skill package. The server parses SKILL.md from the ZIP, extracts files to the target directory, and writes the DB record.
- Endpoint: `POST /api/sandbox/agent/skills/upload` (multipart/form-data, 120s timeout).
- Supports form-field overrides for name, displayName, description, instructions, icon, category.
- `--scope` controls target scope: `personal` (default) or `company`.
- `--replace-skill-id` replaces an existing Skill instead of creating a new one.
- `--auto-rename` auto-renames on name conflict.

## Mandatory Rules (MUST)

- `--file` is required and must be a `.zip` file that exists on disk.
- The ZIP must contain a `SKILL.md` file (with name and content at minimum).
- `--scope` must be `personal` or `company` (default `personal`).
- `--category` must be one of the market category keys when provided.
- `--instructions` supports `@-` to read from stdin.
- This is an ordinary `write` operation and does not require CLI confirmation.

## Market Category Keys

`ae_preset | dev_tool | search_tool | data_query | content_gen | enterprise | life | automation | other`

## Command

```bash
# Upload a personal Skill from ZIP
ae-cli agent +upload-skill --file ./my-skill.zip

# Upload with overrides
ae-cli agent +upload-skill \
  --file ./my-skill.zip \
  --scope personal \
  --name custom-name \
  --display-name "Custom Skill" \
  --description "Override description" \
  --category dev_tool \
  --icon-emoji robot

# Instructions from stdin
echo "You are a helpful assistant..." | \
  ae-cli agent +upload-skill --file ./my-skill.zip --instructions @-

# Replace an existing Skill
ae-cli agent +upload-skill --file ./updated.zip --replace-skill-id <skill-cuid> --version 1.1

# Auto-rename on conflict
ae-cli agent +upload-skill --file ./my-skill.zip --auto-rename

# Dry-run to inspect the request before executing
ae-cli agent +upload-skill --dry-run --file ./my-skill.zip
```

## Parameters

| Parameter            | Required                 | Description                                                                                 |
| -------------------- | ------------------------ | ------------------------------------------------------------------------------------------- |
| `--file`             | Yes                      | Local `.zip` file path                                                                      |
| `--scope`            | No                       | Target scope: `personal` (default) or `company`                                             |
| `--auto-rename`      | No                       | Auto-rename on name conflict                                                                |
| `--replace-skill-id` | No                       | Replace an existing Skill (CUID) instead of creating new                                    |
| `--version`          | Required for replacement | Content version in `major.minor` format. Creation defaults to the package version or `1.0`. |
| `--category`         | No                       | Market category key (see above)                                                             |
| `--name`             | No                       | Override Skill name (from ZIP SKILL.md if omitted)                                          |
| `--display-name`     | No                       | Override display name                                                                       |
| `--description`      | No                       | Override description                                                                        |
| `--instructions`     | No                       | Override instructions (use `@-` to read from stdin)                                         |
| `--icon-emoji`       | No                       | Market icon emoji (e.g. `robot`)                                                            |
| `--icon-color`       | No                       | Market icon color (e.g. `#1E76F0`)                                                          |

## Decision Rules

- The ZIP must contain a `SKILL.md` with at least `name` and content — otherwise the upload fails with `missing_skill_md` or `missing_name_or_content`.
- Form-field overrides take precedence over ZIP SKILL.md content.
- Use `--replace-skill-id` to update an existing Skill's full content from a ZIP (different from `+edit-skill` which edits individual fields).
- Replacement requires `--version`; the server rejects changed content unless the version is strictly higher.
- Use `--auto-rename` when the Skill name might conflict with an existing one.
- `company` scope requires root privileges.
- Use `--dry-run` first to verify the request shape before executing.

## Next Steps on Failure

- `File not found`: verify the local file path.
- `--file must be a .zip file`: only ZIP format is supported.
- Missing `SKILL.md`: ensure the ZIP contains a `SKILL.md` file.
- Missing name or content: add the `name` field and Skill content to `SKILL.md`.
- Missing description: add a description to `SKILL.md` or use `--description`.
- The upload could not be saved: retry once, then contact the administrator if it still fails.
- `409` / name conflict: use `--auto-rename` or choose a different `--name`.
- `SKILL_VERSION_CONFLICT`: read `meta.currentVersion`, choose a strictly higher `major.minor` value, and retry the same replacement with `--version`.
- `SKILL_HISTORY_CONFLICT`: stop retrying and tell the user, "The Skill cannot be safely updated right now. Please contact your administrator."
- Do not recommend internal maintenance commands or expose diagnostic payloads in a customer-facing response.

## Recommended Chaining

- `+upload-skill` → `+list-skills` (verify) → `+get-skill-content` (inspect) → `+edit-skill` (fine-tune) → `+submit-skill` (publish)

Files in this skill

  • accept-skill-share.md1.6 KB
  • add-attachment.md2.4 KB
  • add-mcp.md3.6 KB
  • add-model.md2.5 KB
  • add-skill.md4.6 KB
  • agent-distribution.md9.2 KB
  • approval-effect.md3.2 KB
  • approval-request.md3.5 KB
  • approval-task.md2.6 KB
  • approval-type.md1.4 KB
  • approve-skill.md1.7 KB
  • attachment-stats.md1.5 KB
  • cancel-skill-submission.md1.6 KB
  • command_index.md2.8 KB
  • copy-skill.md2.4 KB
  • create-agent.md3.4 KB
  • create-automation.md6.9 KB
  • del-agent.md1.6 KB
  • del-attachment.md1.2 KB
  • del-mcp.md1.3 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.