How do I install the NPM Trustme skill?

Run npx skillmds@latest add majiayu000/npm-trustme-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is NPM Trustme safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with NPM Trustme?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is NPM Trustme free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published NPM Trustme?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

NPM Trustme by majiayu000 — Agent Skill

Name: NPM Trustme
Rating: 4.666666666666667 (3 reviews)
Author: majiayu000

NPM Trustme

Automate npm Trusted Publisher setup via the npm-trustme CLI. Use when configuring or verifying npm Trusted Publishers for GitHub Actions with npx npm-trustme, including browser automation and WebAuthn passkey approval.

majiayu000 Updated Sep 22, 2026 567 repo stars

File contents

npm-trustme

Overview

Automate npm Trusted Publisher setup in the npm web UI. Requires a one-time WebAuthn approval in a real browser session (passkey or security key).

CLI Quick Start

One-time if browsers are missing: npx playwright install
Ensure (create if missing): npx npm-trustme ensure --yes ...
Check only: npx npm-trustme check ...
Generate workflow: npx npm-trustme workflow init
Doctor: npx npm-trustme doctor

Required Target Inputs

Required: --package, --owner, --repo, --workflow
Optional: --publishing-access, --environment, --maintainer

Default inference:

package: package.json#name
owner/repo: git remote origin
workflow: .github/workflows/npm-release.yml or the only workflow file

Examples

Check:

npx npm-trustme check \
  --package <PACKAGE_NAME> \
  --owner <GITHUB_OWNER> \
  --repo <GITHUB_REPO> \
  --workflow <WORKFLOW_FILE> \
  --publishing-access <PUBLISHING_ACCESS>

Ensure (create if missing):

npx npm-trustme ensure \
  --package <PACKAGE_NAME> \
  --owner <GITHUB_OWNER> \
  --repo <GITHUB_REPO> \
  --workflow <WORKFLOW_FILE> \
  --publishing-access <PUBLISHING_ACCESS> \
  --yes

Dedicated Chrome (keeps main browser open):

npx npm-trustme chrome start
npx npm-trustme ensure --yes

Notes

--env-file can load a specific .env path.
--storage can persist Playwright storage state for faster re-runs.
Inline cookies (Sweet Cookie format) are supported: --inline-cookies-json, --inline-cookies-base64, or --inline-cookies-file.
Requires Node >= 22 (Sweet Cookie uses node:sqlite).
Chrome profile reuse (manual session): --chrome-profile / --chrome-profile-dir / --chrome-user-data-dir / --chrome-path.
Connect to an existing Chrome: --chrome-cdp-url or --chrome-debug-port (Chrome must be launched with remote debugging).
Cookie import: --import-cookies (default true) to copy npm cookies from your main Chrome profile.
npm-trustme ensure prompts for confirmation; use --yes in automated/agent runs.

---name: npm-trustme-2description: Automate npm Trusted Publisher setup via the npm-trustme CLI. Use when configuring or verifying npm Trusted Publishers for GitHub Actions with npx npm-trustme, including browser automation and WebAuthn passkey approval.---# npm-trustme## OverviewAutomate npm Trusted Publisher setup in the npm web UI. Requires a one-time WebAuthn approval in a real browser session (passkey or security key).## CLI Quick Start- One-time if browsers are missing: `npx playwright install`- Ensure (create if missing): `npx npm-trustme ensure --yes ...`- Check only: `npx npm-trustme check ...`- Generate workflow: `npx npm-trustme workflow init`- Doctor: `npx npm-trustme doctor`## Required Target Inputs- Required: `--package`, `--owner`, `--repo`, `--workflow`- Optional: `--publishing-access`, `--environment`, `--maintainer`Default inference:- package: `package.json#name`- owner/repo: `git remote origin`- workflow: `.github/workflows/npm-release.yml` or the only workflow file## ExamplesCheck:```npx npm-trustme check \ --package <PACKAGE_NAME> \ --owner <GITHUB_OWNER> \ --repo <GITHUB_REPO> \ --workflow <WORKFLOW_FILE> \ --publishing-access <PUBLISHING_ACCESS>```Ensure (create if missing):```npx npm-trustme ensure \ --package <PACKAGE_NAME> \ --owner <GITHUB_OWNER> \ --repo <GITHUB_REPO> \ --workflow <WORKFLOW_FILE> \ --publishing-access <PUBLISHING_ACCESS> \ --yes```Dedicated Chrome (keeps main browser open):```npx npm-trustme chrome startnpx npm-trustme ensure --yes```## Notes- `--env-file` can load a specific `.env` path.- `--storage` can persist Playwright storage state for faster re-runs.- Inline cookies (Sweet Cookie format) are supported: `--inline-cookies-json`, `--inline-cookies-base64`, or `--inline-cookies-file`.- Requires Node >= 22 (Sweet Cookie uses node:sqlite).- Chrome profile reuse (manual session): `--chrome-profile` / `--chrome-profile-dir` / `--chrome-user-data-dir` / `--chrome-path`.- Connect to an existing Chrome: `--chrome-cdp-url` or `--chrome-debug-port` (Chrome must be launched with remote debugging).- Cookie import: `--import-cookies` (default true) to copy npm cookies from your main Chrome profile.- `npm-trustme ensure` prompts for confirmation; use `--yes` in automated/agent runs.

Frequently asked questions