The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes npm pack, npx, and python3 to perform package analysis, tarball generation, and linting of the project's output.
[EXTERNAL_DOWNLOADS]: The check_package.sh script fetches publint and @arethetypeswrong/cli from the official npm registry via npx. These are well-known, industry-standard utilities for validating Node.js package integrity and type resolution.
[INDIRECT_PROMPT_INJECTION]: The skill processes local project metadata and file structures. It includes defensive measures to identify and block the inclusion of sensitive information in the final package.
Ingestion points: Reads package.json and file listings from the local directory in scripts/check_package.sh.
Boundary markers: Uses structured JSON output from npm pack to process file lists deterministically.
Capability inventory: Includes file system access for tarball inspection and the ability to execute package-relevant CLI tools.
Sanitization: Employs a Python-based regex filter to explicitly detect and flag sensitive files (e.g., .env, .github/, node_modules/) within the tarball.
[DYNAMIC_EXECUTION]: The check_package.sh script executes an inline Python snippet via a heredoc to parse JSON and perform file list validation. This is a static, deterministic template used solely for processing local package data.

node-packaging