---
title: Publish Your First Skill
description: Step-by-step tutorial to publish your first AI agent skill to the Tank registry in under 10 minutes — with security scanning and permission declarations.
---
# Publish Your First Skill
This tutorial walks you through publishing your first AI agent skill to the Tank registry in under 10 minutes. By the end, your skill will be scanned, versioned, and available for others to install.
## Prerequisites
- Node.js 24+ installed
- A Tank account ([sign up free](/login))
- A skill directory you want to share
## Step 1: Install the Tank CLI
```bash
npm install -g @tankpkg/cli
```
Verify installation:
```bash
tank --version
```
## Step 2: Authenticate
```bash
tank login
```
This opens your browser for GitHub OAuth authentication. Once complete, your API key is stored securely in `~/.tank/config.json`.
## Step 3: Initialize Your Skill
Navigate to your skill directory and run:
```bash
tank init
```
This creates a `tank.json` manifest file:
```json
{
"name": "@acme/my-skill",
"version": "1.0.0",
"description": "A brief description",
"permissions": {
"network": { "outbound": [] },
"filesystem": { "read": [], "write": [] },
"subprocess": false
}
}
```
### Required Fields
| Field | Description |
| ------------- | -------------------------------------- |
| `name` | Scoped skill identifier (`@org/name`) |
| `version` | Semantic version (semver) |
| `description` | Short description for registry listing |
| `permissions` | Explicit capability declarations |
## Step 4: Declare Permissions
Tank enforces least-privilege by default. Declare only what your skill actually needs:
```json
{
"name": "@acme/my-skill",
"version": "1.0.0",
"description": "Audits SEO for a given URL",
"permissions": {
"network": { "outbound": ["api.openai.com"] },
"filesystem": {
"read": ["./data/**"],
"write": ["./output/**"]
},
"subprocess": false
}
}
```
Skills with minimal, specific permissions are easier to review and less likely to fail project permission budgets
during install.
See the [Permissions reference](/docs/permissions) for the full permission schema and best practices.
## Step 5: Run Security Scan
Before publishing, run Tank's 6-stage security scanner locally to catch issues early:
```bash
tank scan
```
This runs:
1. **Ingest** — Hashes files, validates tarball structure
2. **Structure validation** — Manifest integrity, file count and size limits
3. **Static analysis** — AST and regex scanning for dangerous patterns, plus Bandit for Python
4. **Injection detection** — Prompt injection and code injection patterns
5. **Secret scanning** — Credential and API key detection
6. **Supply chain** — Dependency vulnerability scanning (OSV API)
Fix any `CRITICAL` or `HIGH` findings before proceeding. The registry will reject skills that fail the mandatory security pipeline.
`tank scan` runs the local security check. `tank verify` checks lockfile integrity for installed skills — these are
different commands with different purposes.
## Step 6: Publish
```bash
# Validate first (no upload)
tank publish --dry-run
# Publish for real
tank publish
```
Your skill is now:
- Scanned for security issues by the full 6-stage pipeline
- Assigned an audit score (0–10) based on quality and security
- Uploaded to the Tank registry tarball storage
- Available for others to install with `tank install @you/my-skill`
## Step 7: Verify Publication
Check your skill on the registry:
```bash
tank info my-skill
```
Or visit: `https://tankpkg.dev/skills/my-skill`
You'll see:
- The audit score and security scan results
- Version history and semver metadata
- Declared permissions
- Download and star counts
## Next Steps
- [Install a skill](/docs/installing) to see the consumer experience end-to-end
- [Read the CLI reference](/docs/cli) for all available commands and flags
- [Learn about the security model](/docs/security) to understand how the 6-stage pipeline works
- [Security checklist](/docs/security-checklist) to review your skill against best practices before publishing
- [CI/CD Integration](/docs/cicd) to automate publishing with the [GitHub Action](/docs/github-action)