Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dirtybits/agent-skills --skill npm-publishgit clone --depth 1 https://github.com/dirtybits/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dirtybits/agent-skills/npm-publish)<a href="https://agentmods.dev/skills/dirtybits/agent-skills/npm-publish"><img src="https://agentmods.dev/badge/skills/dirtybits/agent-skills/npm-publish/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dirtybits/agent-skills/npm-publish"><img src="https://agentmods.dev/badge/skills/dirtybits/agent-skills/npm-publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.01722 |
| Opus 5 | $0.00036 | $0.00861 |
| Sonnet 5 | $0.00015 | $0.00344 |
| Haiku 4.5 | $0.00007 | $0.00172 |
Grade A, and why
npm-publish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 206 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Npm Publish
Operating Pattern
Use this workflow when preparing, publishing, or verifying an npm package. Treat publishing as a release operation: package versions are immutable, registry state can lag or be filtered by local config, and npm auth errors can look unrelated to the tarball.
- Confirm package scope and working directory.
- In a monorepo, publish from the repo root with
npm publish --workspace <workspace-name> .... - From the package directory, omit
--workspace. - Confirm
package.jsonhas the intendedname,version,license,bin,files,engines,publishConfig, and dependencies.
- In a monorepo, publish from the repo root with
- Confirm the version is new.
- npm versions are immutable. Any republish requires a version bump.
- Check existing versions:
npm view <package> versions dist-tags --json.
- Run release checks before publishing.
- Use the repo's normal quality gates, usually format, tests, and build.
- If a repo-wide build fails for local env state, diagnose before assuming package failure.
- Pack and smoke-test the exact artifact.
- Create the pack destination first; npm does not create it.
- Install the generated tarball globally or in a temp project and run the package's CLI/help/version smoke tests.
- Publish with intentional dist-tags.
- Use
--tag betafor beta/devnet/prerelease packages. - Use
latestonly when the package should be the default install.
- Use
- Verify registry state and installability.
- A successful publish prints
+ <package>@<version>. - Verify package document, dist-tags, access, tarball metadata, and install from a clean npm config or a deliberate security-guard override.
- A successful publish prints
Recommended Command Skeleton
For a workspace package from the repository root:
git switch main
git pull
npm run format:check
npm run test --workspace <workspace-name>
npm run build
mkdir -p /private/tmp/npm-release
npm pack --workspace <workspace-name> --pack-destination /private/tmp/npm-release
npm uninstall -g <package-name>
npm install -g /private/tmp/npm-release/<tarball-name>.tgz
<binary-name> --version
<binary-name> --help
npm whoami
npm publish --workspace <workspace-name> --tag beta --access public
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 206 lines · 73 tokens per session scan A 37d7e9c95f30
npm-publish is a skill published in the GitHub repository dirtybits/agent-skills (2 stars, last pushed 1mo ago), licensed MIT. It adds 73 tokens to every session and 1,722 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
plugin-publish
A release guide for publishing Zhin.js plugins to npm, the JavaScript package registry, and to the Zhin plugin marketplace. It covers package metadata, versioning, release checks, and submission requirements.
git-workflow
Git branching, commit conventions, rebase vs merge, conflict resolution, and release tagging. Use when setting up a git workflow, writing commits, resolving conflicts, or preparing a release.
cut-release
Cut a clean release — bump versions across all files, update changelog, create GitHub release.
antigravity-maintainer-batch-release
Run protected AAS maintainer sweeps, PR merge batches, canonical sync, Core preview checks, and scripted releases. Use for repository maintenance, main alignment, CLI/MCP/Workbench changes, or release.
release-announcement
Write a release announcement — changelog, blog post, in-app note, or social post — that leads with user impact, names the audience, and includes upgrade/migration steps without filler.
version-release
Choose and apply the correct semantic version bump for this repository. Use for every user-visible release, before merge when a change set should ship as patch, minor, or major, and whenever package/plugin/desktop version metadata must stay synchronized.