# Portable Skill Package for Other Hermes Instances (2026-05)

## Trigger

Use this when BOSS asks to "打包这个 skill 发给别人/其他 Hermes 使用" or wants a low-configuration portable delivery of the xianyu-hunter workflow.

## Package Shape

Preferred export directory:

```text
/Users/chick/.Hermes/workspace/exports/xianyu-hunter-hermes-skill/
├── skill/xianyu-hunter-monitor/      # copied Hermes skill with references/
├── project/xianyu-hunter/            # portable web/CLI project
├── README.md                         # end-user installation/use guide
└── install.sh                        # one-command installer
```

Create both archives for compatibility:

```text
xianyu-hunter-hermes-skill.zip
xianyu-hunter-hermes-skill.tar.gz
```

## What to Include

- `~/.hermes/skills/social-media/xianyu-hunter-monitor/` including `SKILL.md` and `references/`.
- The local `xianyu-hunter` project source including `server.mjs`, `lib/`, `public/`, `tools/`, `package.json`, `package-lock.json`, docs/assets if useful.
- A safe `data/notify-config.example.json` with disabled/empty channels.
- Empty `data/.gitkeep` so the directory exists after unpack.
- `README.md` with: prerequisites, one-command install, manual install, login flow, start command, sample monitoring command, Hermes usage examples, and safety boundaries.
- `install.sh` that copies the skill into `$HERMES_HOME/skills/social-media/xianyu-hunter-monitor`, copies the project to `${XIANHU_INSTALL_DIR:-$HOME/xianyu-hunter}`, runs `npm install`, and runs `npx playwright install chromium`.

## What to Exclude

Always exclude runtime/sensitive state:

```text
.git/
node_modules/
browser-data/
data/tasks.json
data/config.json
data/notify-config.json
reports/
.runtime/
*.log
```

Do not include real cookies, historical product data, API keys, notification targets, generated reports, or server logs.

## Verification Checklist

Before sending the archive:

1. Verify forbidden paths are absent from the export tree and archive.
2. Run a secret scan for common API-key/token patterns outside documentation files.
3. Build both `tar.gz` and `zip`.
4. Print SHA-256 hashes and archive sizes.
5. List an archive sample and confirm it contains `README.md`, `install.sh`, the skill directory, and project source.
6. Send the archive with `MEDIA:/absolute/path/to/file` so Feishu uploads it as an attachment.

Example verification commands:

```bash
cd /Users/chick/.Hermes/workspace/exports
for bad in \
  'project/xianyu-hunter/browser-data' \
  'project/xianyu-hunter/node_modules' \
  'project/xianyu-hunter/.git' \
  'project/xianyu-hunter/reports' \
  'project/xianyu-hunter/data/tasks.json' \
  'project/xianyu-hunter/data/config.json' \
  'project/xianyu-hunter/data/notify-config.json'; do
  test ! -e "xianyu-hunter-hermes-skill/$bad" || { echo "BAD_INCLUDED $bad"; exit 2; }
done

tar -czf xianyu-hunter-hermes-skill.tar.gz xianyu-hunter-hermes-skill
zip -qr xianyu-hunter-hermes-skill.zip xianyu-hunter-hermes-skill
shasum -a 256 xianyu-hunter-hermes-skill.tar.gz xianyu-hunter-hermes-skill.zip
```

## User-Facing Response Pattern

Keep the response practical and concise:

- Say it is packaged.
- State sensitive/runtime data was excluded.
- Provide both archive attachments if available.
- Include the minimal install/start commands.
- Include one natural-language Hermes example.