b-open-io/npm-publish
skills/npm-publish/SKILL.md
This skill should be used when the user wants to publish a package to npm, bump a version, release a new version, or mentions "npm publish", "bun publish", "version bump", or "release to npm". Handles version bumping, changelog updates, git push, npm publishing, and automatic token rotation via agent-browser when auth expires. Do not trigger for unrelated uses of "release" (e.g. GitHub releases, press releases).
$ install --global
skillsauthnpx skillsauth add b-open-io/prompts npm-publishInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 10, 2026, 3:54 AM206.6s7 files scanned
SKILL.md
- name:
- npm-publish
- version:
- 3.1.1
- description:
- This skill should be used when the user wants to publish a package to npm, bump a version, release a new version, or mentions "npm publish", "bun publish", "version bump", or "release to npm". Handles version bumping, changelog updates, git push, npm publishing, and automatic token rotation via agent-browser when auth expires. Do not trigger for unrelated uses of "release" (e.g. GitHub releases, press releases).
- allowed-tools:
- Bash(agent-browser:*), Bash(npm:*), Bash(bun:*), Bash(git:*), Bash(pbpaste:*), Bash(pbcopy:*), Bash(chmod:*), Bash(bash:*), Bash(grep:*), Bash(sed:*), Bash(sleep:*)
npm-publish
MANDATORY — Read Before Doing Anything
NEVER ask the user for an OTP code. Auth is handled by scripts + agent-browser.
NEVER run manual npm/bun commands like npm whoami, npm view, bun publish, or npm publish.
You MUST run these scripts. Do NOT skip steps.
Step 1: Preflight
bash ${CLAUDE_SKILL_DIR}/scripts/preflight.sh
Handles deterministically: version check against npm registry, bump if needed (resets gaps), build, commit log output. Pass minor or major to override default patch bump.
Step 2: Write Changelog
Read the commit log from preflight output. If CHANGELOG.md exists, add entry at top matching existing format. If not, create one. Use the version from preflight output. Categorize: Breaking Changes, Added, Changed, Fixed, Security, Deprecated.
Step 3: Release (commit + push + publish)
bash ${CLAUDE_SKILL_DIR}/scripts/release.sh [--access public]
Commits, pushes, then calls publish.sh. If publish.sh outputs PUBLISH_SUCCESS — done, go to Step 4.
If publish.sh outputs AUTH_FAILED
The agent must orchestrate token setup. Do NOT call setup-token.sh as one long command. Run it in two phases with user communication between them.
Phase 1 — Fill the form:
bash ${CLAUDE_SKILL_DIR}/scripts/setup-token.sh fill
Status codes:
FORM_READY:<username>— form is filled in Chrome, proceed to tell userNOT_LOGGED_IN— tell user: "Sign in to npmjs.com in Chrome, then I'll retry"FORM_NOT_FOUND— tell user: "Could not find the token form. The page may have changed."
After getting FORM_READY, tell the user directly (not inside a bash command):
I've opened the npm token creation form in Chrome and filled it out (cli-publish, 7-day, read+write, all packages). Scroll down and click Generate token when ready.
Phase 2 — Capture the token:
bash ${CLAUDE_SKILL_DIR}/scripts/setup-token.sh capture
This polls until the token appears on the page, clicks the Copy button, reads from clipboard, writes to ~/.npmrc, and clears clipboard. The token never appears in terminal output.
Status codes:
TOKEN_SAVED— success, retry publishCAPTURE_TIMEOUT— tell user: "Could not capture token. Copy it from Chrome and I'll write it to ~/.npmrc"
After TOKEN_SAVED, retry publish:
bash ${CLAUDE_SKILL_DIR}/scripts/publish.sh [--access public]
Tell user: "Complete the OTP checkbox in your browser if prompted."
Step 4: Verify (background)
bash ${CLAUDE_SKILL_DIR}/scripts/verify.sh <package-name> <version>
Run with run_in_background: true. Exponential backoff (5s, 10s, 20s, 40s, 60s).
Key Architecture Principle
Scripts output status codes. The agent interprets them and talks to the user. Script output is hidden inside collapsed bash commands — the user won't see it. All user-facing communication must be direct agent messages OUTSIDE of bash calls.
Related Skills
b-open-io/claudex
tools
VerifiedTrustedCommunity
This skill should be used when a Claude Code session needs to keep working after Anthropic usage runs out, or when the user asks to run the Claude Code harness on GPT-5.6 Sol. Trigger phrases include "my Anthropic usage ran out", "I'm out of Claude usage", "usage limit reached, what now", "keep working on another model", "run Claude Code on GPT-5.6 Sol", "use GPT-5.6 Sol as the model", "set up claudex", "claudex isn't working", "route the harness through CLIProxyAPI", or "bill against my ChatGPT/Codex subscription". It stands up a local proxy so the Claude Code CLI runs on OpenAI's Codex backend as an escape hatch, and diagnoses that setup when it drifts. macOS + Homebrew.
14SKILL.mdUpdated Jul 17, 2026
b-open-io/visual-wayfinder
testing
VerifiedTrustedCommunity
This skill should be used when the user asks to "open Visual Wayfinder", "answer a Wayfinder ticket visually", "turn this decision into a configurator", "show Wayfinder choices as a dashboard", "prototype the Wayfinder questionnaire", or wants interactive choice cards, tradeoff controls, rankings, ranges, toggles, and consequence previews for one active Wayfinder decision. It wraps the Wayfinder skill and JSON Render; it never replaces the tracker or resolves more than the active decision.
14SKILL.mdUpdated Jul 16, 2026
b-open-io/visual-proposal
development
VerifiedTrustedCommunity
This skill should be used when the user asks to "make a visual proposal", "write this up so I can share it", "present these options visually", "diagram the trade-offs", "turn this plan into something reviewable", or requests a shareable design pitch, architecture proposal, RFC, options comparison, or visual roadmap for work that has not been built. It produces one self-contained, theme-aware HTML page led by grounded diagrams. Use visual-review instead for completed code changes; do not use this skill for internal task tracking.
14SKILL.mdUpdated Jul 16, 2026
b-open-io/plugin-settings
tools
VerifiedTrustedCommunity
This skill should be used when the user asks to "add plugin settings", "make a plugin configurable", "store per-project plugin configuration", "use settings.local.json", "create a plugin state file", "expose skill settings in Agent Master", or "add a skill interface". Distinguishes official Claude Code settings from project-owned configuration and documents bOpen Agent Master skill interface discovery.
14SKILL.mdUpdated Jul 16, 2026