The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/publish.py uses subprocess.run() to execute git and npm commands. These are legitimate operations for the skill's purpose (auditing repositories and checking registry status). The script includes safety checks, such as validating workflow paths to prevent directory traversal and using --dry-run modes by default.
[SAFE]: The skill implements a 'User Profile' contract via scripts/profile_store.py, which is a standardized way to persist non-sensitive user preferences across sessions. The implementation explicitly forbids and validates against the storage of secrets, tokens, or passwords.
[SAFE]: The skill provides clear instructions for GitHub Actions OIDC (trusted publishing), which is a security best practice to avoid using long-lived secrets in CI/CD pipelines.

lov-npm-publisher