---
source_url: https://gist.githubusercontent.com/gwyntel-git/f5b7a27fc9ee0938cffc5f4445068d97/raw/github-gist-sync.md
gist: https://gist.github.com/gwyntel-git/f5b7a27fc9ee0938cffc5f4445068d97
name: github-gist-sync
description: "Sync GwynTel skills to public GitHub Gists — redacts PII on COPIES only, compresses with caveman, publishes, and updates frontmatter. Originals stay untouched."
version: "1.0.0"
author: gwyntel-git
---
source_url: https://gist.githubusercontent.com/gwyntel-git/f5b7a27fc9ee0938cffc5f4445068d97/raw/github-gist-sync.md
gist: https://gist.github.com/gwyntel-git/f5b7a27fc9ee0938cffc5f4445068d97

# GitHub Gist Sync — Skill Publishing Pipeline

> **Canonical gist:** (published on first sync)
> **Principle:** Originals untouched. Redact COPIES only. Publish copies. Update frontmatter on originals.

## When to Use

- Publishing a new skill to a public gist
- Re-syncing an existing skill after changes
- Bulk-publishing all GwynTel skills
- After a security audit — re-sync to update public gists with fresh redactions

## Architecture

```
~/.hermes/skills/           ← ORIGINALS (untouched, full real values, operational)
         ↓ copy to temp
/tmp/gist-sync/             ← COPIES (redacted, compressed, published, then deleted)
         ↓ publish
GitHub Gists (gwyntel-git)  ← PUBLIC (redacted, never contains real secrets/PII)
         ↓ patch frontmatter
~/.hermes/skills/           ← ORIGINALS get gist: URL added/updated
```

**Originals are NEVER modified except to add/update the `gist:` frontmatter field.** All redaction happens on disposable copies in `/tmp/gist-sync/`.

## Who Gets Published

Only skills with `author: gwyntel-git` or `author: gwyntel` in frontmatter get published. These are **GwynTel original skills** — written by Gwyn, not built-in to hermes-agent.

### Built-in skills to SKIP (author: Hermes Agent, Orchestra Research, Nous Research, community)

These ship with the hermes-agent repo and are NOT Gwyn's to publish:
- `apple/*`, `leisure/*`, `email/*`, `dogfood`
- `creative/ascii-*`, `creative/excalidraw`, `creative/manim-video`, `creative/p5js`, `creative/popular-web-designs`, `creative/songwriting-and-ai-music`
- `data-science/*`, `note-taking/*`
- `github/*` (5 built-in)
- `mcp/mcporter`, `mcp/native-mcp`
- `media/gif-search`, `media/heartmula`, `media/songsee`, `media/youtube-content`
- `mlops/*` (28 built-in — Orchestra Research)
- `productivity/google-workspace`, `productivity/linear`, `productivity/nano-pdf`, `productivity/notion`, `productivity/ocr-and-documents`, `productivity/powerpoint`
- `red-teaming/godmode`
- `research/arxiv`, `research/blogwatcher`, `research/llm-wiki`, `research/polymarket`, `research/research-paper-writing`
- `smart-home/openhue`, `social-media/xitter`
- `software-development/plan`, `software-development/requesting-code-review`, `software-development/subagent-driven-development`, `software-development/systematic-debugging`, `software-development/test-driven-development`, `software-development/writing-plans`
- `devops/webhook-subscriptions`

### MLOps skills that are NOT Gwyn's (community-installed, skip)
- `mlops/cloud/lambda-labs`
- `mlops/evaluation/huggingface-tokenizers`, `mlops/evaluation/nemo-curator`, `mlops/evaluation/saelens`
- `mlops/inference/instructor`, `mlops/inference/tensorrt-llm`
- `mlops/models/llava`
- `mlops/openai-responses-api`
- `mlops/training/accelerate`, `mlops/training/flash-attention`, `mlops/training/pytorch-lightning`, `mlops/training/simpo`, `mlops/training/slime`, `mlops/training/torchtitan`
- `mlops/vector-databases/chroma`, `mlops/vector-databases/faiss`, `mlops/vector-databases/pinecone`, `mlops/vector-databases/qdrant`

### Skills to NEVER publish
- `productivity/mychart-portal-access` — medical portal, sensitive even redacted
- `productivity/safeway-pharmacy-access` — pharmacy, same concern
- `devops/mywythorne-site-deploy` — Rowan's project (Rowan stays private)

## Redaction Rules (Applied to COPIES Only)

Before publishing a copy, apply these replacements in order:

### 1. Hardcoded credentials
Replace with env var references:
- `$MYCHART_PASSWORD` → `$MYCHART_PASSWORD`
- Any `api_key="real-key"` → `api_key=os.environ["SERVICE_API_KEY"]`
- Any `Authorization: Bearer sk-...` → `Authorization: Bearer $SERVICE_API_KEY`
- Any `--token XXX` → `--token $SERVICE_TOKEN`

### 2. Personal hostnames and IPs
- `$TRANSCODE_HOST` → `$TRANSCODE_HOST`
- `$TAILSCALE_IP` → `$TAILSCALE_IP`
- `$HONCHO_TAILSCALE_IP` → `$HONCHO_TAILSCALE_IP`
- `$PROXMOX_HOST` → `$PROXMOX_HOST`
- Other `100.x.x.x` Tailscale IPs → `$TAILSCALE_IP`
- Other `192.168.x.x` LAN IPs → `$LAN_IP`

### 3. Personal identifiers
- `gwyntel-git` (GitHub) → keep (public anyway)
- `gwyneth` (peer name) → keep (Honcho peer, not secret)
- `radorrans` → `$MAC_USERNAME`
- `/Users/$MAC_USERNAME/` → `/Users/$MAC_USERNAME/`
- `/Users/$MAC_USERNAME/` → `/Users/$MAC_USERNAME/`

### 4. Email addresses and domains
- `$SAFEWAY_EMAIL` → `$SAFeway_EMAIL`
- `$MYCHART_EMAIL` → `$MYCHART_EMAIL`
- `$PERSONAL_EMAIL` → `$PERSONAL_EMAIL`
- `$FAMILY_EMAIL` → `$FAMILY_EMAIL`
- `$MAC_USERNAME@gmail.com` → `$PERSONAL_EMAIL`
- `$DOMAIN_1`, `$DOMAIN_2`, `$DOMAIN_3` → `$DOMAIN_1`, `$DOMAIN_2`, `$DOMAIN_3`

### 5. Cloudflare Zone IDs and tokens
- 32-char hex CF Zone IDs → `$CF_ZONE_ID_1`, `$CF_ZONE_ID_2`, `$CF_ZONE_ID_3`
- `$CF_TOKEN...` tokens → `$CF_TOKEN`

### 6. Rowan references
- Any mention of Rowan's Discord ID, real name, or personal details → `$PARTNER_INFO`
- Rowan-specific project details → scrub or generalize

## Compression (Optional)

After redaction, optionally apply caveman compression to reduce skill size:
1. Strip verbose explanations while keeping commands and technical details
2. Convert paragraphs to bullet points
3. Remove redundant examples
4. Keep code blocks intact

This is a **per-publish decision** — ask the user or check if skill already has a compressed version.

## Publishing Workflow

### Single Skill

```bash
# 1. Copy to temp
mkdir -p /tmp/gist-sync
cp ~/.hermes/skills/<category>/<skill-name>/SKILL.md /tmp/gist-sync/<skill-name>.md

# 2. Apply redactions to the COPY (use sed/patch)
# Follow redaction rules above

# 3. Check if gist already exists (frontmatter has gist: field)
grep -q '^gist:' ~/.hermes/skills/<category>/<skill-name>/SKILL.md

# 4a. New gist
gh gist create /tmp/gist-sync/<skill-name>.md --public -d "<skill description>"
# Grab URL from output

# 4b. Existing gist (update)
gh gist edit <GIST_ID> /tmp/gist-sync/<skill-name>.md

# 5. Patch original frontmatter with gist URL
# Add/replace `gist:` field in YAML frontmatter
# Add/replace `> **Canonical gist:**` line in doc body

# 6. Cleanup
rm /tmp/gist-sync/<skill-name>.md
```

### Bulk Publish (All GwynTel Skills)

Use `execute_code` or a subagent to iterate over all skills with `author: gwyntel-git`, applying the pipeline to each. Rate-limit to avoid GitHub API throttling (1-2 second delay between publishes).

### Re-sync (After Changes)

After modifying a skill, re-sync to update the public gist:
1. Same pipeline — the `gh gist edit` call updates the existing gist in place
2. No need to create a new gist ID

## Frontmatter Convention

Every published skill MUST have:

```yaml
---
name: skill-name
description: What it does
version: "1.0.0"
author: gwyntel-git
gist: https://gist.github.com/gwyntel-git/GIST_ID
---
```

And in the doc body, right after the heading:

```markdown
> **Canonical gist:** https://gist.github.com/gwyntel-git/GIST_ID
```

## Verification

After publishing, verify:
1. `curl -s "https://gist.github.com/gwyntel-git/GIST_ID" | grep -i 'REDACTED\|$MYCHART_PASSWORD\|sk-\|$CF_TOKEN'` — should return nothing
2. Gist URL resolves and content matches the redacted copy
3. Original skill file still has all real values intact
4. Frontmatter has correct `gist:` URL

## Pitfalls

- **NEVER redact originals** — always work on copies in `/tmp/gist-sync/`
- **Rowan stays private** — scrub any Rowan personal info before publishing
- **CF Zone IDs look like git hashes** — 32-char hex strings in context of Cloudflare = Zone ID, not a commit hash. Redact them.
- **`gh gist edit` replaces ALL files** in a single-file gist this is fine, but multi-file gists need care
- **GitHub rate limits** — bulk publish with 1-2s delays; `gh` handles 403s with retry but can still fail on large batches
- **Frontmatter `gist` field must be exact** — wrong URL = broken self-reference. Always grab the URL from `gh gist create` output.
- **Companion files** — skills with `references/`, `templates/`, `scripts/` subdirs: only SKILL.md goes to gist. Companion files are runtime-only.