hos-npm-publish-audit

Audits npm package tarballs before publishing by inspecting packed file inventories and entry points.

32|Updated Aug 29, 2026
One-click install
npx skills add https://github.com/openreachtech/hora-skills-ort-support --skill hos-npm-publish-audit-openreachtech
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: hos-npm-publish-audit
Source: https://github.com/openreachtech/hora-skills-ort-support/tree/main/kit/skills/hos-npm-publish-audit
Command: npx skills add https://github.com/openreachtech/hora-skills-ort-support --skill hos-npm-publish-audit-openreachtech

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Lint and tests only read the repository, so they never reveal what actually ships in an npm tarball. This Skill performs the final pre-publish audit by reading the real packed inventory, catching files that must not ship, missing files, broken entry points, and documentation claims that no longer match the package. ## Core Features & Use Cases - Tarball Inventory Reading: Runs npm pack --dry-run and reads every line of the output, treating the inventory as the only true statement of what ships rather than trusting the files: allowlist. - Entry Point Verification: Installs the packed tarball into an empty project and resolves main, exports, bin, and types from the consumer's side, since a path that resolves in the repository can be absent in the tarball. - Documentation and Policy Scanning: Walks the README's own instructions against reality and greps for project-specific rules no linter enforces, such as forbidden names or frozen files. - Use Case: Before publishing a new version of an internal library, run this audit to confirm the tarball contains the built output, excludes test fixtures, and that the README's install command and examples still match the package. ## Quick Start Audit this package before publishing by running npm pack --dry-run, reviewing the full file inventory, and verifying the entry points resolve from a fresh install.

Frequently Asked Questions about hos-npm-publish-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check what files will be published to npm?

Run npm pack --dry-run to print the exact tarball inventory, then read every line of the output. The files field in package.json is only an allowlist of intent; the registry also adds package.json, README, and LICENSE automatically.

Why do npm packages ship files that should not be published?

Tests, fixtures, and configs ship when the files allowlist is incomplete or when an entry stops matching after a rename, and nothing fails to warn you. Only reading the packed inventory reveals what actually reaches consumers.

How do I verify npm package entry points before publishing?

Install the packed tarball into an empty project and import it there, checking main, exports, bin, and types from the consumer's side. A path that resolves inside the repository can be absent from the tarball.

Does passing lint and tests mean an npm package is ready to publish?

No. Lint and tests read the repository tree, not the tarball, so they say nothing about what ships. A clean repository can still produce a tarball with missing files, stale builds, or leaked fixtures.

What are the limitations of a pre-publish npm audit?

The audit reports findings but does not repair them; fixing files, entry points, or documentation belongs to their owners. It also does not decide whether or when to publish, which remains a human judgment call.