Sign inGet started

Automates semantic version bumps across all plugin manifests, builds and verifies the project, creates git tags and GitHub releases, regenerates the changelog, and publishes the package to npm.

Lift—not yet benchmarked
70
Trustsecurity · quality · license · upkeep
Scan Cautionrisk 23/100
License—metadata + link-out
Cautionrisk 23/100scanner: sb-static v1 (SkillSpector integration is a seam)
info
References credential file

in the maintainer's Mac `~/.npmrc`; he issues a new one every month. It is

SKILL.md:58
info
References credential file

for the maintainer (`open <url>`), replace the token value in `~/.npmrc` with

SKILL.md:70
info
References credential file

`PASTE_NEW_TOKEN_HERE`, and `open -e ~/.npmrc` so he can paste the new token

SKILL.md:71
medium
Semantic review: exfiltration

The skill directs the agent to open an external URL that could expose conversation data. — “open https://www.npmjs.com/settings/thedotmack/tokens/granular-access-tokens/new”

SKILL.md:69
medium
Semantic review: conceal

The skill hides credential usage from the user. — “Never ask for the token in chat.”

SKILL.md:72
low
Semantic review: description does not match behavior

The model judged the instructions to do something other than the stated description.

SKILL.md

Methodology: static pass over the pinned file tree — secret patterns, binaries, install hooks, URL allowlist comparison, allowed-tools breadth. Full methodology →