automate-npm-release
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The workflow templates reference official GitHub Actions from well-known organizations including 'actions' (GitHub) and 'pnpm'.
- [EXTERNAL_DOWNLOADS]: References the 'voidzero-dev/setup-vp' action and 'vp' command-line tool from VoidZero Inc., a recognized technology organization in the JavaScript ecosystem.
- [EXTERNAL_DOWNLOADS]: Recommends the use of 'changelogithub' and 'bumpp', which are standard, widely-adopted open-source utilities for npm release management and changelog generation.
- [SAFE]: The skill prioritizes security best practices by advocating for npm trusted publishing and OpenID Connect (OIDC) via 'id-token: write' permissions, minimizing the need for long-lived secrets.
Audit Metadata