The Agent Skills Directory

[SAFE]: The skill implements a standard workflow for publishing packages to the npm registry. The logic is transparent and focuses on legitimate build and deployment tasks.- [COMMAND_EXECUTION]: The skill utilizes the authorized Bash tool to execute standard development commands, including bun run build, npm pack, and npm publish. These operations are well-defined within the scope of the skill's purpose.- [DATA_EXFILTRATION]: Project metadata is read from package.json using cat and jq. This data access is limited to fields required for the publishing process (e.g., name, version, and bin) and does not involve unauthorized external transmission of sensitive information.- [PROMPT_INJECTION]: The skill processes configuration data from package.json (Ingestion points: SKILL.md). While the data is passed into the agent's context without specific boundary markers (Boundary markers: Absent), the risk is mitigated by the use of jq for structured extraction (Sanitization: Present) and the skill's restricted execution environment (Capability inventory: Bash commands).

bun-publish