The Agent Skills Directory

[SAFE]: The skill is explicitly designed to improve security posture by removing long-lived secrets and enforcing strict release protocols.- [EXTERNAL_DOWNLOADS]: The skill utilizes well-known security auditing tools including 'zizmor' via Docker and the '@e18e' CLI for dependency analysis. These tools are standard in the JavaScript security ecosystem and are used here for diagnostic purposes.- [COMMAND_EXECUTION]: The skill performs configuration of local package managers (npm, pnpm, yarn, bun) to enable security features like dependency cooldown periods and disabling install scripts.- [REMOTE_CODE_EXECUTION]: The provided GitHub Action templates follow high-security standards, specifically using SHA hashes instead of tags for actions and isolating build environments from the publishing environment with limited permissions (id-token: write only in the final job).- [DATA_EXFILTRATION]: The skill actively reduces the risk of credential theft by instructing users to delete 'NPM_TOKEN' secrets and move toward tokenless publishing via OpenID Connect (OIDC).

secure-npm-package