publish-npm-package
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill includes instructions to search for existing authentication tokens within sensitive local shell configuration files, specifically
~/.zshrc,~/.bashrc,~/.zprofile, and~/.bash_profile. This is intended for legitimate diagnostic purposes but targets files typically containing credentials. - [INDIRECT_PROMPT_INJECTION]: The skill relies on ingesting and processing data from repository files to determine the appropriate release flow, creating an attack surface where malicious metadata could influence agent behavior.
- Ingestion points: Data is collected from
package.json,.npmrc, workspace manifests, and git repository state (tags/remotes). - Boundary markers: There are no explicit instructions to the agent to treat data from these files as untrusted or to use specific delimiters during processing.
- Capability inventory: The skill utilizes powerful tools including
npm publish,npm pack,gh secret set, and git operations for tagging and pushing to the remote repository. - Sanitization: The provided scripts (e.g.,
check-package-json.mjs) parse JSON but do not perform security-focused sanitization of the values before they are used to drive decision-making logic.
Audit Metadata