z-npm-publish
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is primarily instructional, providing templates for
package.jsonand GitHub Actions workflows that follow industry-standard security practices for package publishing. - [EXTERNAL_DOWNLOADS]: The GitHub Action workflow template references
actions/checkout@v6andactions/setup-node@v6. These are official GitHub actions and well-known services used for standard CI/CD operations. - [INDIRECT_PROMPT_INJECTION]: The skill explicitly includes a security best practice section warning against shell injection in GitHub Actions. It correctly advises using environment variables (e.g.,
process.env.GITHUB_REF_NAME) rather than direct shell interpolation (${{ ... }}) to handle untrusted input from event metadata.
Audit Metadata