publish-npm-packages
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill promotes the adoption of OIDC-based Trusted Publishing, which eliminates the need for hardcoded npm tokens in CI/CD environments, significantly reducing the risk of credential theft.
- [SAFE]: The documentation includes explicit security boundaries, instructing the agent to never read, output, or record tokens and to always request user confirmation before performing sensitive actions like publishing or modifying permissions.
- [SAFE]: The skill provides templates for GitHub Actions, GitLab CI/CD, and CircleCI that follow the principle of least privilege, specifically recommending the use of granular tokens for read-only operations and environment-scoped permissions.
- [SAFE]: Instructions for monorepo publishing use standard npm CLI commands (
npm trust,npm publish --workspaces) without introducing third-party scripts or untrusted dependencies. - [SAFE]: The skill identifies specific version requirements (npm 11.5+) needed to support modern security protocols, ensuring the user environment is compatible with current best practices.
Audit Metadata