pollyhub-cli-enhanced

SKILL.md

---
name: pollyhub-cli-enhanced
description: Install the PollyHub CLI to publish, install, and search Polly Agent Skills from the registry. Use when you want to install the pollyhub command line tool, manage skills, or interact with the PollyHub registry from the terminal.
tags: cli, pollyhub, registry
---
# PollyHub CLI

The official CLI for the [PollyHub](https://pollyhub.app.pallassecurity.com) Polly Skills Registry.

## Setup

### 1. Install the CLI

The CLI must be installed to `~/lib/node` (not system-wide — no root access):

```bash
npm install -g https://pollyhub.app.pallassecurity.com/api/download/cli --prefix ~/lib/node
export PATH="$HOME/lib/node/bin:$PATH"
```

Always prepend `$HOME/lib/node/bin` to PATH before invoking any `pollyhub` command.

### 2. API Key

The API key is stored in the pollyhub-cli skill config. Read it with:

```bash
python3 -c "
import json
cfg = json.load(open('/home/polly/skills/user/pollyhub-cli/.skill_config.json'))
print(cfg['env']['POLLYHUB_API_KEY'])
"
```

### 3. Registry

```bash
export POLLYHUB_REGISTRY=https://pollyhub.app.pallassecurity.com
```

---

## Installing a Skill

After installing, copy the skill into the correct Polly directory:

```bash
export PATH="$HOME/lib/node/bin:$PATH"
export POLLYHUB_REGISTRY=https://pollyhub.app.pallassecurity.com
pollyhub install <skill>
cp -r ~/.cursor/skills/<skill> ~/skills/user/<skill>
```

> The CLI installs to `~/.cursor/skills/` by default — always copy to `~/skills/user/` afterward.

---

## Read-Only CLI Commands

These work reliably without a TTY:

```bash
pollyhub search <query>       # search the registry
pollyhub info <skill>         # show versions, author, scan status
pollyhub list                 # list locally installed skills
```

---

## Publishing a Skill

**Never use `pollyhub publish` via the CLI.** It requires an interactive TTY for prompts
and silently does nothing when stdin is not a terminal. Its frontmatter parser also
silently drops multi-line YAML `description: >` values.

**Always publish via the API directly:**

### Step 1 — Check ownership

Before publishing, verify the slug is either new or owned by you:

```bash
export PATH="$HOME/lib/node/bin:$PATH"
export POLLYHUB_REGISTRY=https://pollyhub.app.pallassecurity.com
pollyhub info <slug> 2>&1
```

If the skill exists and `author_name` is not yours, choose a different slug (e.g. `granola-enhanced`).

### Step 2 — Publish via API

```python
import urllib.request, json, os

REGISTRY = "https://pollyhub.app.pallassecurity.com"
API_KEY  = json.load(open(os.path.expanduser(
    "~/skills/user/pollyhub-cli/.skill_config.json")))["env"]["POLLYHUB_API_KEY"]
SKILL_DIR = "/home/polly/skills/user/<skill-name>"

# Collect all non-hidden files
files = {}
for root, dirs, filenames in os.walk(SKILL_DIR):
    dirs[:] = [d for d in dirs if not d.startswith('.')]
    for fname in filenames:
        if fname.startswith('.'): continue
        full = os.path.join(root, fname)
        rel  = os.path.relpath(full, SKILL_DIR)
        try:
            files[rel] = open(full).read()
        except Exception:
            pass  # skip binary files

payload = json.dumps({
    "slug":        "<skill-slug>",
    "name":        "<skill-name>",
    "description": "<single-line description>",
    "tags":        ["tag1", "tag2"],
    "version":     "1.0.0",
    "changelog":   "Initial release",
    "files":       files,
    "is_public":   True,
}).encode()

req = urllib.request.Request(
    f"{REGISTRY}/api/skills",
    data=payload,
    headers={"x-api-key": API_KEY, "Content-Type": "application/json"},
    method="POST"
)
with urllib.request.urlopen(req) as r:
    data = json.loads(r.read().decode())

print(json.dumps(data, indent=2))
```

Check `data["version"]["scan_status"]`:
- `"clean"` — ready to install
- `"flagged"` — published with warnings (still installable; admin can review)
- `"blocked"` — downloads disabled until admin review

---

## Subsequent Versions

To publish a new version of an existing skill, use the same API call with a bumped `version`.
The registry appends a new version entry; it does not overwrite the previous one.