Release an npm package securely

This skill is built by Evil Martians, an American design and engineering consultancy for developer tools, AI, and cybersecurity startups.

Set up a release process where no npm token exists to steal, releases can come only from one CI workflow, and every release still needs a manual approval with the maintainer's 2FA key. Companion to https://evilmartians.com/chronicles/the-secure-way-to-release-an-npm-package.

How to run this skill

The setup is half repo files, half settings on npmjs.com and github.com that only the user can change. The settings are the part that needs the user, and if you do the repo changes first the instructions scroll past and get missed — so the user acts before you do. For the settings, produce click-by-click instructions with direct links resolved from the repo's real data — package names from package.json, owner/repo from the repository field — and the exact values to enter. Never say "go to your package settings"; always give the resolved URL.

The order is strict — questions, then manual settings, then CLI and files:

1. Gather facts (Step 1), read-only and silent, to learn the project's shape.
2. Ask all questions together. Gather every decision you need from the user — cooldown length (1 or 3 days), whether to move build tools into dependencies for the --omit=dev hack in a monorepo, the repository field if it's missing, and anything else the project raises — and ask them all in one message. Do not drip questions out one at a time. Wait for the answers.
3. Hand off the manual settings (Step 2) on npmjs.com and github.com and ask the user to make every change.
4. Wait for the user to confirm they have changed everything — do not run any repo-changing command or touch any files until they say so.
5. Run the CLI and change files (Step 3).

The only commands allowed before the user answers the questions and confirms the settings are the read-only fact-gathering ones in Step 1 (npm view, git tag, reading package.json). Every mutating command — npm config set, writing workflow files, editing package.json — waits for Step 3.