lov-npm-publisher
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
gitandnpmCLI tools through its Python scripts to automate package publication. These executions are constrained to necessary release operations and use safe argument handling via list-based subprocess calls.- [EXTERNAL_DOWNLOADS]: The skill interacts with the official npm registry atregistry.npmjs.orgto check package status and verify versions. This is a standard and safe operation for a package management tool.- [SAFE]: The skill explicitly handles credentials securely. Thescripts/profile_store.pyutility implements a blocklist to prevent the persistence of sensitive data like tokens or secrets, and thescripts/publish.pyscript audits packages without requiring or logging long-lived credentials.
Audit Metadata