npm-release-via-github-actions
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing various shell commands and repository-defined scripts to perform the release workflow.
- It executes lifecycle scripts defined in
package.jsonsuch asnpm run verify,npm run build, andnpm run pack:dryto ensure the package is ready for release. - It uses the GitHub CLI (
gh) for creating releases (gh release create), listing runs (gh run list), and monitoring workflow progress (gh run watch). - It performs standard Git operations (
git add,git commit,git push) to update the version and changelog in the repository. - It executes a hardcoded Node.js one-liner via
node -eto programmatically verify that the lockfile version matches the package version. - [SAFE]: The skill demonstrates a strong security posture for its intended use case.
- It explicitly prevents local publishing (
npm publish), which reduces the risk of credential leakage from the developer's machine and ensures auditability through CI/CD. - It interacts exclusively with well-known and trusted services, specifically GitHub and the npm registry.
- No patterns of obfuscation, data exfiltration, or malicious prompt injection were detected.
Audit Metadata