How do I install the NPM Guide skill?

Run npx skillmds@latest add xonovex/npm-guide in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is NPM Guide safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with NPM Guide?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is NPM Guide free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published NPM Guide?

xonovex (@xonovex) published this skill. Their other Agent Skills are listed on their SkillMD profile.

NPM Guide by xonovex — Agent Skill

Name: NPM Guide
Author: xonovex

NPM Guide

Use when publishing an npm package or checking that one is ready to publish. Triggers on prompts about npm publish, publish-readiness or package.json validation (name/version/license/repository/files/publishConfig/private), idempotent publishing (skip if the version already exists), provenance and access flags, dist-tags, or platform-specific (os/cpu/libc) native-binary packages, even when the user doesn't say 'npm'.

xonovex 7b1a9a2 6 files · 15.5 KB Updated Sep 17, 2026

File contents

npm Publishing Guidelines

Validate publish-readiness and publish packages idempotently, with correct access, provenance, dist-tags, and platform fields.

Core Principles

npm requires only name + version: license / repository / files are house policy, not npm rules, and private: true blocks publishing outright, see references/publish-check.md
Provenance needs CI + OIDC: --provenance only works from a supported runner with id-token permission, the public registry, and a matching repository; it errors elsewhere, see references/publish.md
Access is derived: unscoped packages are always public; scoped packages default to restricted and need --access public on first publish, see references/publish.md
Platform packages gate install: os / cpu / libc restrict where a native-binary package installs; inject and restore those fields safely, see references/publish.md

Operations

publish-check: validate a package.json is publish-ready, separating npm rules from policy, see references/publish-check.md
publish: publish a package idempotently with provenance / access / dist-tag / platform handling, see references/publish.md

Gotchas

Hard-requiring license / repository / files exceeds npm (it warns, it doesn't block), and rejecting a repository shorthand string like github:org/repo is wrong: treat the three as policy
publishConfig.access is only meaningful for @scoped names; unscoped packages cannot be restricted: don't hard-require it universally
--provenance fails outside a supported CI/OIDC environment: gate it on CI, never expect a local no-op
files supports globs and dist/ is built later: don't existence-check glob entries or build outputs; package.json / README / LICENSE / main are always included
Inject-then-restore of os / cpu / libc must restore on failure (try/finally), and libc is a silent no-op unless os includes linux
A pre-release published without --tag lands on latest and installs by default: derive a dist-tag from the version

Progressive Disclosure

Read references/publish-check.md - Load when validating that a package is ready to publish
Read references/publish.md - Load when publishing (idempotency, provenance, access, dist-tag, platform fields)

---name: npm-guidedescription: Use when publishing an npm package or checking that one is ready to publish. Triggers on prompts about npm publish, publish-readiness or package.json validation (name/version/license/repository/files/publishConfig/private), idempotent publishing (skip if the version already exists), provenance and access flags, dist-tags, or platform-specific (os/cpu/libc) native-binary packages, even when the user doesn't say 'npm'.---# npm Publishing GuidelinesValidate publish-readiness and publish packages idempotently, with correct access, provenance, dist-tags, and platform fields.## Core Principles- **npm requires only name + version**: `license` / `repository` / `files` are house policy, not npm rules, and `private: true` blocks publishing outright, see [references/publish-check.md](references/publish-check.md)- **Provenance needs CI + OIDC**: `--provenance` only works from a supported runner with `id-token` permission, the public registry, and a matching `repository`; it errors elsewhere, see [references/publish.md](references/publish.md)- **Access is derived**: unscoped packages are always public; scoped packages default to restricted and need `--access public` on first publish, see [references/publish.md](references/publish.md)- **Platform packages gate install**: `os` / `cpu` / `libc` restrict where a native-binary package installs; inject and restore those fields safely, see [references/publish.md](references/publish.md)## Operations- **publish-check**: validate a package.json is publish-ready, separating npm rules from policy, see [references/publish-check.md](references/publish-check.md)- **publish**: publish a package idempotently with provenance / access / dist-tag / platform handling, see [references/publish.md](references/publish.md)## Gotchas- Hard-requiring `license` / `repository` / `files` exceeds npm (it warns, it doesn't block), and rejecting a `repository` shorthand string like `github:org/repo` is wrong: treat the three as policy- `publishConfig.access` is only meaningful for `@scoped` names; unscoped packages cannot be restricted: don't hard-require it universally- `--provenance` fails outside a supported CI/OIDC environment: gate it on CI, never expect a local no-op- `files` supports globs and `dist/` is built later: don't existence-check glob entries or build outputs; `package.json` / `README` / `LICENSE` / `main` are always included- Inject-then-restore of `os` / `cpu` / `libc` must restore on failure (try/finally), and `libc` is a silent no-op unless `os` includes `linux`- A pre-release published without `--tag` lands on `latest` and installs by default: derive a dist-tag from the version## Progressive Disclosure- Read [references/publish-check.md](references/publish-check.md) - Load when validating that a package is ready to publish- Read [references/publish.md](references/publish.md) - Load when publishing (idempotency, provenance, access, dist-tag, platform fields)

Frequently asked questions