Best fit
Review the files a JavaScript package proposes to publish, alongside its declared entry points and an optional previous-release manifest.
// Developer Tools
npm Publish Payload Preflight
Review an npm pack file list for missing declared files, credential-like filenames and payload changes before publishing.
We earn a commission on eligible purchases after a new Agensi signup through these links. We also sell our own skills on Agensi.Format: Agent skill, not a browser app. You need an AI agent that can load its instructions and use the required tools.
Package requirements: Python 3.10+ in a code-execution-capable agent. Supply normalized UTF-8 JSON and a fresh output directory. Retrieve the supporting script and schema through Agensi; do not assume a local scripts folder exists.
You get: findings.csv with stable codes and record identifiers; review-manifest.csv with every reviewed item; result.json with READY, REVIEW or BLOCK; report.md with the review handoff.
Licence and purchase details
Review the package licence at the destination.
Review the offer and agent-connection requirements at the linked marketplace. Buying a skill does not include an AI-agent subscription or setup service.
Agensi access: Creator-connected Agensi delivery checked October 23, 2026: all four delivered texts match the sealed v1.0.1 package after line-ending normalization; six synthetic execution controls passed. Independent buyer checkout and full installed-package use were not tested.
What problem does npm Publish Payload Preflight solve?
Review the files a JavaScript package proposes to publish, alongside its declared entry points and an optional previous-release manifest.
Use it to
- Review a pack dry-run before npm publish.
- Catch sensitive-looking files in a tarball manifest.
- Compare the current payload with a prior release.
What it returns
- findings.csv with stable codes and record identifiers
- review-manifest.csv with every reviewed item
- result.json with READY, REVIEW, or BLOCK gate
- report.md with a human-readable decision handoff
A representative input and result
input {"package":{"name":"tiny-kit","version":"1.0.0"},"pack_files":["package.json","dist/index.js"]}
result REVIEW; two records reviewed. RUNTIME_INTENT_REVIEW: a build folder alone does not establish a root runtime entry. Confirm whether this is a runtime, types-only or data package. Nothing was published.
Access and approval boundaries
- Read access to one user-supplied local JSON evidence file.
- Write access only to the selected local output directory.
- No browser, network, credential, account, environment-variable, or external-action permission.
Known limitations
- Not a secret-content scanner or proof of Node import behavior. Does not run npm or publish. Conditional, pattern and fallback entry points require intended-runtime review.
- Use a new output folder. Exit 0 means execution completed, not approval to act. Review result.json for the gate.
// choose with context
Is npm Publish Payload Preflight the right skill?
It returns
findings.csv with stable codes and record identifiers. review-manifest.csv with every reviewed item. result.json with READY, REVIEW or BLOCK. report.md with the review handoff.
Do not use it as
Not a secret-content scanner or proof of Node import behavior. Does not run npm or publish. Conditional, pattern and fallback entry points require intended-runtime review.
Compatibility, access, version, and licence
- Reads or accesses
- Declared local scope: one owner-selected local JSON input, one owner-selected local output directory.
- Compatibility
- Python 3.10+ in a code-execution-capable agent. Supply normalized UTF-8 JSON and a fresh output directory. Retrieve the supporting script and schema through Agensi; do not assume a local scripts folder exists.
- Version
- Package v1.0.1; Agensi platform release v1.1.
- Licence
- Review the package licence and seller terms at the linked destination.
Questions
Does it change or upload anything?
No. It reads supplied local evidence and writes only to the selected output directory.
Is this an AI judgment?
No. The packaged checker is deterministic and applies documented rules to the supplied input.
What does a ready result mean?
It means no automated finding was produced. The responsible owner still reviews the original source and decides what to do.
How does malformed input behave?
Invalid JSON, duplicate identifiers, missing required arrays, and invalid core values fail closed.
Can I audit the result?
Yes. Every finding carries a stable code, record identifier, severity, source, and message.
npm Publish Payload Preflight keeps proof and approval boundaries visible.
The listing includes the tested package, realistic samples, declared permissions, and known limitations.
Get npm Publish Payload Preflight on Agensi