node-packaging
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the 'npx' command to download and run the 'publint' and 'arethetypeswrong' auditing utilities from the official npm registry.
- [COMMAND_EXECUTION]: A bash script (
scripts/check_package.sh) is employed to automate package packing and metadata inspection using 'npm' and 'python3'. - [SAFE]: The skill implements a security-focused check that scans the generated package tarball and blocks the inclusion of sensitive files, such as '.env' files, '.github' directories, and local configuration, ensuring data privacy during the publishing process.
Audit Metadata