omnidist
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and run the @omnidist/omnidist package from the npm registry. This is expected behavior for a tool-specific workflow skill.
- [COMMAND_EXECUTION]: The skill executes various commands to initialize and manage release workflows, such as npx -y @omnidist/omnidist@latest init and npx -y @omnidist/omnidist@latest ci. It includes instructions for verifying and reviewing all generated files before committing them.
- [SAFE]: The skill follows security best practices by instructing the user to configure NPM_PUBLISH_TOKEN and UV_PUBLISH_TOKEN as repository secrets rather than embedding sensitive credentials in the workflow files.
Audit Metadata