Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/kvdm-co-pilot/create-cmpnpx agentmods add skills/kvdm-co-pilot/create-cmp/npm-publishWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/npm-publish)<a href="https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/npm-publish"><img src="https://agentmods.dev/badge/skills/kvdm-co-pilot/create-cmp/npm-publish/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/npm-publish"><img src="https://agentmods.dev/badge/skills/kvdm-co-pilot/create-cmp/npm-publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00150 | $0.03160 |
| Opus 5.5 | $0.00060 | $0.01264 |
| Sonnet 5.5 | $0.00030 | $0.00632 |
| Haiku 4.5 | $0.00015 | $0.00316 |
Grade A, and why
npm-publish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 258 lines — stays where its author put it; the contents beside it link to each section on GitHub.
npm-publish — release create-cmp to the npm registry
This repo publishes to npm as create-cmp-cli (not create-cmp — that name is an unrelated
placeholder — and not create-cmp-app — that's a real, unrelated CMP generator). The installed
command stays create-cmp regardless; package.json maps both create-cmp and create-cmp-cli
as bin names so either invocation works.
Auth — token-first, login fallback
Publishing is unattended when a granular npm access token lives in Karel's ~/.npmrc. The
token is user-managed infrastructure, exactly like his SSH key or gh auth: the agent USES the
ambient auth, it never sees, handles, stores, or moves the token itself.
Check auth before anything else:
npm whoami
- Prints a username → authed, proceed. Everything below runs without Karel in the loop.
- Errors (
ENEEDAUTH) → auth is missing/expired. STOP and tell Karel to refresh it (below). Do not attempt to work around it.
One-time token setup (Karel does this himself, not the agent):
- npmjs.com → avatar → Access Tokens → Generate New Token → Granular Access Token
- Permissions: Read and write. Packages: only ours — every name under
packages/*/package.jsonandpackages/aliases/*/package.json(node scripts/ground-truth.mjslists them and counts them —prooflane-harnessandprooflane-receiptsamong them) — never "all packages". - Enable Bypass two-factor authentication (this is what makes publish non-interactive).
- Pick an expiration; when it lapses,
npm whoamistarts failing and publish PUTs return E404 — that's the signal to regenerate. - Add to
~/.npmrcby hand (or via a local installer that prompts with hidden input)://registry.npmjs.org/:_authToken=npm_XXXX
Hard rules for the agent:
- Never ask for, read, echo, or write the token value. Never
cat/grepthe auth line of~/.npmrc.npm whoamiis the only auth probe you need. - Never create a repo-level
.npmrcand never copy auth config into the project — a committed token is a leaked token. - If auth is dead, the fix is Karel regenerating the token or running
npm logininteractively. Both are his steps; hand off and wait.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago Changed · +11 lines 703165eecf8a
- 29d ago Changed · +5 lines 9dbd0e697cad
- 1mo ago Changed · +15 lines 7a6bb3f56fd8
- 1mo ago First seen · 227 lines · 150 tokens per session scan A 9581a0c9bb7c
npm-publish is a skill published in the GitHub repository kvdm-co-pilot/create-cmp (0 stars, last pushed 2d ago), licensed MIT. It adds 150 tokens to every session and 3,160 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
mobile-checkpoint
Checkpoint workflow for mobile development safety. Save/restore Android project state at critical points.
prepare-merge-request
Use when about to open or update a pull/merge request, push a feature branch, run git add/git commit on finished work, or state that the test suite passes — in a Kotlin Multiplatform or Android Gradle project. Three gates in order - prove the suites actually ran by counting JUnit XML instead of trusting BUILD…
release-kotlin-library
Use when preparing, publishing, or checking readiness for a Kotlin library release, including verifying its gradle-maven-publish-plugin prerequisite, reconciling changelogs and API snapshots, and checking publication.
compose-multiplatform
Use when building one shared Compose UI in Kotlin across Android, iOS, and desktop — commonMain @Composables, expect/actual, source-set placement, native interop, multiplatform ViewModel/navigation/Koin. NOT a single-platform native build (that is kotlin-android / swift-ios), and NOT Dart/Flutter cross-platform UI…
release-process
Step-by-step release checklist for Squad — prevents v0.8.22-style disasters.
release-app-store-changelog
Create user-facing App Store release notes from git history. Use when asked to generate release changelog, App Store "What's New" text, or release notes based on git tags.