agentmods.dev

npm-package

npm-package is a skill for Claude Code, Codex from remorses/kimaki. It costs 78 tokens per session (6,066 once invoked), scanned C, original, MIT.

A ready-made setup for creating TypeScript packages published through npm, the JavaScript package registry. It defines how source code is built, exported, tested, and included in the published package.

In plain words
What is it for?
Use it when starting or repairing an npm package written in TypeScript. It helps configure source-to-build compilation, package.json fields, public entry points, and included files.
Why use it?
It removes repeated decisions about package metadata, module format, exports, and build output. It also helps prevent packages from publishing incomplete or incorrectly linked files.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Needs its repository: it reads a path above its own folder, which exists only inside the repository. The line is const packageJson = require("../package.json") as {.

not rated 1.4krepo +10 today C scan SkillSpector: warn 78 tokens original MIT

Good fit Use it when starting or repairing an npm package written in TypeScript. It helps configure source-to-build compilation, package.json fields, public entry points, and included files.

Compare 6 skills from other repositories ↓
View source ↗ remorses/kimaki kimaki.dev
About the project

Kimaki is a Discord-based orchestrator for OpenCode, an AI coding agent that edits files on a user's machine. It maps each project to a Discord channel and each coding session to a thread, allowing users to start, resume, search, and fork work through conversations. Catalogue add-ons provide Kimaki-related workflows for coding agents.

remorses/kimaki · 1,402 stars · on GitHub · kimaki.dev

Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/remorses/kimaki
agentmods
npx agentmods add skills/remorses/kimaki/npm-package

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for npm-package

README.md
[![agentmods](https://agentmods.dev/badge/skills/remorses/kimaki/npm-package.svg)](https://agentmods.dev/skills/remorses/kimaki/npm-package)
Your own site
<a href="https://agentmods.dev/skills/remorses/kimaki/npm-package"><img src="https://agentmods.dev/badge/skills/remorses/kimaki/npm-package.svg" alt="Measured on agentmods" height="20"></a>
Per session 78 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 6,066 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 3 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium Agent Snooping · line 139
    Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
    Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
  • medium MCP Rug Pull · line 392
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 404
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00078 $0.06066
Opus 5 $0.00039 $0.03033
Sonnet 5 $0.00016 $0.01213
Haiku 4.5 $0.00008 $0.00607

Measured 8d ago against content hash 45a0aaadf050, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade C, and why

npm-package scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

**Never put `rm -rf`, `rimraf`, or any delete in `build`.** `build` runs on

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s https://raw.githubusercontent.com/owner/repo/main/README.md # NEVER pipe to head/tail
skills/npm-package/SKILL.md · 693 lines

How it starts

The opening of the file, as written. The whole thing — 693 lines — stays where its author put it; the contents beside it link to each section on GitHub.

npm-package

Use this skill when scaffolding or fixing npm packages.

Package.json rules

  1. Always set "type": "module".

  2. Always fill "description".

  3. Always include GitHub metadata:

    • repository with type, url, and directory
    • homepage
    • bugs

  4. Always include meaningful keywords.

  5. Always export ./package.json.

  6. Exports structure must include:

    • "." for runtime entrypoint (dist)
    • "./src" and "./src/*" pointing to .ts source files

  7. In every export object, put types first.

    • For runtime exports (for example "."), point types to emitted declaration files in dist.
    • For source exports ("./src", "./src/*"), point types to source files in src (not ./dist/*.d.ts).

  8. Always include default in exports.

  9. files must include at least:

    • src
    • dist
    • any runtime-required extra files (for example schema.prisma)
    • skills/ directory if the package ships an agent skill (see "Agent skill" section below). Skill files live at skills/<name>/SKILL.md, never at the package root.
    • if tests are inside src and gets included in dist, it's fine. don't try to exclude them
    • Do NOT create package-level README.md files. In workspaces, keep one README at the repository root. Package READMEs don't get read by anyone. The root README is the single source of truth for the whole project.

  10. scripts.build should be tsc && chmod +x dist/cli.js (skip the chmod if the package has no bin). No bundling. Optionally include running scripts with tsx if needed to generate build artifacts.

    Never put rm -rf, rimraf, or any delete in build. build runs on every edit, watch loop, and CI test job. Deleting dist/ there breaks live dev servers that hold it in their module graph (Bun fails with Failed to load bundled module '<pkg>/dist/index.js' until restarted) and throws away incremental compilation. A stale file only matters in a published tarball, which prepublishOnly already handles.

Read the full file on GitHub · 693 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 693 lines · 78 tokens per session scan C 45a0aaadf050

Subscribe to this mod's changes

npm-package is a skill published in the GitHub repository remorses/kimaki (1,402 stars, last pushed today), licensed MIT. It adds 78 tokens to every session and 6,066 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

LanguagesTypeScriptclawdbotdiscordopenclaw-alternativeopencode
Related

Other skills, from other repositories

silo-extension-builder

Help the user design, write, compile, and install a Silo extension from a natural-language description. The extension follows the same format as any publishable Silo extension and can be shared via npm or a tarball URL when ready.

silo-code/silo · 53 tokens

javascript-typescript

Professional JavaScript and TypeScript development skill covering modern ES6+, TypeScript, Node.js, Express, React, testing frameworks, and best practices. Use this skill when developing JavaScript/TypeScript applications, building React/Node.js projects, implementing RESTful APIs, or need guidance on modern JS/TS…

HK-hub/AgentSkills · 69 tokens

apple-cktool-js

Builds and troubleshoots CloudKit automation with Apple's CKTool JS packages, including @apple/cktool.database, @apple/cktool.target.nodejs, and @apple/cktool.target.browser. Use when Codex needs typed JavaScript or TypeScript for CloudKit schema import, export, validation, or reset; container and team discovery…

bastos/skills · 141 tokens

cli-builder

Guide for building TypeScript CLIs with Bun. Use when creating command-line tools, adding subcommands to existing CLIs, or building developer tooling. Covers argument parsing, subcommand patterns, output formatting, and distribution.

joelhooks/swarm-tools · 47 tokens

mainframe-typescript-backend

Develop, debug, review, or test server-side TypeScript in Node.js services and established Next.js server layers. Use proactively for backend APIs, business rules, persistence, jobs, realtime behavior, server integrations, and focused backend tests. Do not use for substantial client-only UI, Python services, data or…

CATWILLgh/MAINFRAME · 75 tokens

typescript-engineering

Comprehensive TypeScript engineering guidance for coding agents. Use when writing, reviewing, refactoring, or debugging TypeScript or TSX code; designing public APIs; fixing tsconfig or strict-mode issues; resolving generic, union, narrowing, async, module, or type-inference problems; improving runtime validation…

mfmezger/ai_agent_dotfiles · 122 tokens