npm-trusted-publishing
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves a purely technical purpose, providing guidance on configuring npm OpenID Connect (OIDC) authentication to improve supply chain security for package publishing.
- [SAFE]: The included validation script (
scripts/validate.mjs) performs local static analysis on configuration files (package.jsonand GitHub Actions workflows) to ensure the presence of required permissions and metadata. It does not perform network operations or use dangerous execution patterns. - [SAFE]: The workflow template (
references/publish.yml) uses well-known, established GitHub Actions for checkout and Node.js setup. While it references future version numbers (e.g., Node 24, actions/setup-node@v6), these do not pose a security risk and appear to be forward-looking placeholders. - [SAFE]: All external URLs point to official npm documentation and the primary npm registry (
registry.npmjs.org), which are well-known and trusted services. - [SAFE]: No prompt injection, obfuscation, persistence, or data exfiltration vectors were detected across the skill's instructions or scripts.
Audit Metadata