npm
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements robust security controls for handling sensitive credentials.
- It uses the
op(1Password) CLI to retrieve credentials at runtime rather than storing them in plain text. - It creates a temporary
.npmrcfile with restricted permissions (0600) and ensures its deletion upon exit via shell traps. - It implements a
redact()function to prevent NPM tokens and TOTP codes from being written to logs or standard output. - It enforces execution within
tmuxto ensure that the environment containing decrypted secrets is short-lived and controlled.
Audit Metadata