Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add avsm/ocaml-claude-marketplace --skill npm-publishinggit clone --depth 1 https://github.com/avsm/ocaml-claude-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/avsm/ocaml-claude-marketplace/npm-publishing)<a href="https://agentmods.dev/skills/avsm/ocaml-claude-marketplace/npm-publishing"><img src="https://agentmods.dev/badge/skills/avsm/ocaml-claude-marketplace/npm-publishing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/avsm/ocaml-claude-marketplace/npm-publishing"><img src="https://agentmods.dev/badge/skills/avsm/ocaml-claude-marketplace/npm-publishing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.00930 |
| Opus 5 | $0.00022 | $0.00465 |
| Sonnet 5 | $0.00009 | $0.00186 |
| Haiku 4.5 | $0.00004 | $0.00093 |
Grade A, and why
npm-publishing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 154 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OCaml to NPM Publishing
When to Use This Skill
Invoke this skill when:
- Setting up npm publishing for OCaml projects
- Configuring js_of_ocaml or wasm_of_ocaml
- Discussing browser targets for OCaml
- Creating the npm branch workflow
Branch Structure
main branch - OCaml source code, dune build files, opam packages
npm branch - Built JavaScript/WASM assets, package.json, README for npm
The npm branch is an orphan branch with no shared history.
Dune Build Rules
Library with Browser Bindings
In lib/js/dune:
; Library compiled to bytecode (required for js_of_ocaml)
(library
(name mylib_js)
(public_name mylib-js)
(libraries mylib brr)
(modes byte)
(modules mylib_js))
; Executable compiled to both JS and WASM
(executable
(name mylib_js_main)
(libraries mylib_js)
(js_of_ocaml)
(modes js wasm)
(modules mylib_js_main))
; Friendly filename for JS
(rule
(targets mylib.js)
(deps mylib_js_main.bc.js)
(action (copy %{deps} %{targets})))
; Friendly filename for WASM
(rule
(targets mylib.wasm.js)
(deps mylib_js_main.bc.wasm.js)
(action (copy %{deps} %{targets})))
; Install web assets
(install
(package mylib-js)
(section share)
(files
mylib.js
mylib.wasm.js
(glob_files_rec (mylib_js_main.bc.wasm.assets/* with_prefix mylib_js_main.bc.wasm.assets))))
dune-project Package
(package
(name mylib-js)
(synopsis "Browser library via js_of_ocaml/wasm_of_ocaml")
(depends
(ocaml (>= 5.1.0))
(mylib (= :version))
(js_of_ocaml (>= 5.0))
(js_of_ocaml-ppx (>= 5.0))
(wasm_of_ocaml-compiler (>= 5.0))
(brr (>= 0.0.6))))
Creating the NPM Branch
# Create orphan branch
git switch --orphan npm
# Add npm-specific files
git add package.json README.md LICENSE release.sh .gitignore
git commit -m "Initial npm package setup"
# Switch back
git checkout main
NPM Branch Files
See templates/ for:
package.json.templaterelease.sh.template
package.json
{
"name": "mylib-jsoo",
"version": "1.0.0",
"description": "Description here",
"browser": "mylib.js",
"license": "MIT",
"repository": {
"type": "git",
"url": "git+https://github.com/user/repo.git#npm"
},
"files": [
"mylib.js",
"mylib.wasm.js",
"mylib_js_main.bc.wasm.assets/",
"README.md",
"LICENSE"
]
}
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 154 lines · 44 tokens per session scan A 81b13c38f28b
npm-publishing is a skill published in the GitHub repository avsm/ocaml-claude-marketplace (35 stars, last pushed 10d ago), licensed ISC. It adds 44 tokens to every session and 930 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release
Evaluate readiness and publish to crates.io.
release-kotlin-library
Use when preparing, publishing, or checking readiness for a new Kotlin library version in a repository using gradle-maven-publish-plugin, including release changelog reconciliation, API snapshots, and publication verification.
release-process
Pre-release validation, npm publish procedures, and post-publish verification.
crawlkit
Maintain and release the crawlkit Go library, preserving downstream compatibility for gitcrawl, slacrawl, discrawl, and notcrawl.
pi-sync
Daily upstream-sync job for the pi Go port — fetch upstream pi, triage every change since the recorded pin, port what's in scope, verify idiomatic + parity via independent reviews, update the ledger, and push. Use for "sync with upstream", "porting job", or as the scheduled daily run.
dart-package-maintenance
Guidelines for maintaining external Dart packages, covering versioning, publishing workflows, and pull request management. Use when updating Dart packages, preparing for a release, or managing collaborative changes in a repository.