lov-npm-publisher

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes git and npm CLI tools through its Python scripts to automate package publication. These executions are constrained to necessary release operations and use safe argument handling via list-based subprocess calls.- [EXTERNAL_DOWNLOADS]: The skill interacts with the official npm registry at registry.npmjs.org to check package status and verify versions. This is a standard and safe operation for a package management tool.- [SAFE]: The skill explicitly handles credentials securely. The scripts/profile_store.py utility implements a blocklist to prevent the persistence of sensitive data like tokens or secrets, and the scripts/publish.py script audits packages without requiring or logging long-lived credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 12:55 AM
Security Audit — agent-trust-hub — lov-npm-publisher