Add safe HTML deck publishing with Slidesfly skill 🤖🤖🤖

[rare]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Adds a focused Agent Skill for publishing an already-completed local HTML presentation with
Slidesfly, verifying the returned reader URL, and reporting the visibility and local-ownership
boundary.

This is intentionally narrower than the existing publish-to-pages skill. That skill remains the
right choice for repository-backed static hosting and general web content. This contribution is for
users who explicitly choose Slidesfly's presentation reader workflow after the HTML deck already
exists.

Affiliation disclosure: I maintain Slidesfly. Slidesfly is a hosted service with free and paid
usage. The Skill discloses that relationship in its opening section, uses a neutral technical tone,
links only to the necessary quickstart/security/source references, and names GitHub Pages as the
alternative when it better fits the request.

Safety behavior includes:

• no upload from a how-to question or other non-authorizing prompt;
• a local-only, mode-aware preflight for the exact artifact, anonymous size limit, and external
  scripts;
• the complete dependency-free Slidesfly CLI 0.1.3 bundled with the Skill, so users get the same
  publish, auth, claim, list, update, version, restore, visibility, protection, and delete behavior
  without a remote installer or a second handwritten API client;
• no secret, API-key, config, or claim-token disclosure;
• no automatic software installation, login, visibility change, claim, or in-place update;
• one retry at most for transient failures and no retry after content-policy rejection.

The bundled runner is generated from the official CLI source in
rare/slidesfly#125, mirrored in
rare/slidesfly-integrations#16, and pinned
at SHA-256 cd94667fc714e998d87fd47e1ad94bd4d44e23a0b0f0fb70671df1a22365b699.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Validation

• npm run skill:validate — all 396 Skill folders valid.
• npm start — generated docs/README.skills.md; subsequent build is idempotent.
• node --test eng/*.test.mjs — 39 passed, 0 failed.
• gh skill publish <isolated-skills-directory> --dry-run — passed.
• GitHub Copilot CLI 1.0.77 discovered the Skill as a project Skill.
• Bundled runner reports 0.1.3, exposes the full CLI help, and matches the generated source artifact
  byte-for-byte at the pinned SHA-256.
• node --test skills/publish-html-deck-with-slidesfly/scripts/preflight.test.mjs — 4 passed,
  including anonymous size enforcement and owned-mode handling.
• No API key, claim token, real customer artifact, or new deck upload was used in validation.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and
will be licensed under the MIT License.

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

🔒 PR Risk Scan Results

Scanned 4 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	3

Severity	Rule	File	Line	Match
ℹ️	skill-script-touched	skills/publish-html-deck-with-slidesfly/scripts/preflight.mjs	1	skills/publish-html-deck-with-slidesfly/scripts/preflight.mjs
ℹ️	skill-script-touched	skills/publish-html-deck-with-slidesfly/scripts/preflight.test.mjs	1	skills/publish-html-deck-with-slidesfly/scripts/preflight.test.mjs
ℹ️	skill-script-touched	skills/publish-html-deck-with-slidesfly/scripts/slidesfly.mjs	1	skills/publish-html-deck-with-slidesfly/scripts/slidesfly.mjs

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[rare]

Addressed the soft-gate remote-shell-execution finding in aad9850. The Skill no longer contains or executes curl | sh; when the CLI is missing or outdated it now stops and directs the user to complete the official Quickstart independently. Re-ran npm run skill:validate, npm start, and the 39 upstream Node tests successfully.

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ publish-html-deck-with-slidesfly (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/publish-html-deck-with-slidesfly
✅ publish-html-deck-with-slidesfly (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

[rare]

Updated the submission to use the complete, dependency-free Slidesfly CLI bundle instead of the earlier PATH dependency or a handwritten anonymous-only publisher. The Skill now ships runner 0.1.3 (SHA-256 cd94667fc714e998d87fd47e1ad94bd4d44e23a0b0f0fb70671df1a22365b699), preserves full CLI command/config/JSON compatibility, and keeps a separate local-only mode-aware preflight. Source and parity guards are in rare/slidesfly#125; the canonical public mirror update is rare/slidesfly-integrations#16. Validation: 396/396 Skill folders, 39/39 engineering tests, 4/4 preflight tests, dry-run packaging, and Copilot CLI 1.0.77 discovery. No credentials or deck uploads were used.

[rare]

Source chain update: rare/slidesfly#125 has now merged as 3a06be4a370aab29093ebee21cde4fedbbe3fd74, and the canonical public mirror rare/slidesfly-integrations#16 has merged as 137ffda60a67e9a9965cad34c547ff3ecdac450d. The reviewed runner remains byte-identical at SHA-256 cd94667fc714e998d87fd47e1ad94bd4d44e23a0b0f0fb70671df1a22365b699. This upstream PR is now waiting only for maintainer review; all automated checks remain green.