npm SKILL.md skillA
npm from steipete/agent-scripts is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add steipete/agent-scripts/npm@git:20261016.d602e8aPins git:20261016.d602e8a in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- steipete/agent-scripts
- Path
skills/npm/SKILL.md- Versions recorded
- 6
- Latest version
- git:20261016.d602e8a, committed Oct 16, 2026
- First version recorded
- Jul 4, 2026
- Size
- 4,592 bytes
- Repository stars
- 7,386
- License
- MIT
npm registry ops: login, whoami, names, publish; 1Password tmux.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# npm Use for npm registry/account tasks: `npm whoami`, package availability, package reservation, publish, org checks, and auth debugging. ## Auth - Use `one-password` first for secret rules. - Never run `op` directly in the shell tool. - Primary item: `npm Registry - steipete - Release Automation` in `Molty`. - Default to `OP_SERVICE_ACCOUNT_TOKEN`; no desktop unlock. The item carries the working registry session (`registry_token`) plus username/password/TOTP fallback. - Desktop `npmjs` fallback is explicit only: pass `--account my.1password.com` when Molty is unavailable and the user wants the fallback. Explicit `release`/`publish` requests are consent for its unlock prompt. - Stop and ask if the item is missing, the account/vault is ambiguous, credentials are malformed, npm denies package access, or the requested package/version does not match the repo release target. - Run npm auth work inside one task window of the shared `op-work` tmux session (`clawdbot-op.sock`; see `one-password`). Reuse the window on failure; kill it when the npm task is done. Never mint an npm-specific socket or session. - Keep npm auth in a temp npmrc; delete it after the command. …
Read the whole file at its exact version.
How to install
mdr add steipete/agent-scripts/npm@sha256:5eca4f0822029e69The line at the top of this page pins the label git:20261016.d602e8a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_pokythaq2mkaasha)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 6 versions of this file, between Jul 4, 2026 and Oct 16, 2026, about one every 21 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261016.d602e8a latest | 2026-10-16 | d602e8a | 4,592 B | A | view · diff |
| git:20260902.833f3fe | 2026-09-02 | 833f3fe | 4,530 B | A | view · diff |
| git:20260715.6a2be27 | 2026-07-15 | 6a2be27 | 3,773 B | A | view · diff |
| git:20260704.b4035ab | 2026-07-04 | b4035ab | 3,614 B | A | view · diff |
| git:20260704.4a368c1 | 2026-07-04 | 4a368c1 | 3,536 B | A | view · diff |
| git:20260704.327e300 | 2026-07-04 | 327e300 | 3,485 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4592 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
steipete/agent-scripts · 7,386 stars · license MIT · pushed 2026-10-18 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_pokythaq2mkaasha GET https://markdownregistry.com/api/v1/resolve?ref=steipete/agent-scripts/npm GET https://markdownregistry.com/api/v1/blob/5eca4f0822029e69535309c93b30aaea1379a59588a919f89da1d50c88420d19
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from steipete/agent-scripts
Every file in steipete/agent-scripts