Is marketplace-publish safe to install?

SaferSkills independently audited marketplace-publish (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

marketplace-publish/SKILL.md · 1 file

marketplace-publish/SKILL.md2.0 KB · Markdown

name: marketplace-publish

description: Unified marketplace publisher for VS Code Marketplace (via vsce), iOS App Store / TestFlight (via Expo EAS submit), and Google Play Console (via Expo EAS submit). Single command surface around publish.sh + submit.sh. Pre-flight validates credentials before doing anything destructive. --dry-run by default skips uploads. Use when the user says "publish the extension", "submit to App Store", "ship to Play Store", "marketplace publish", "release the vsix", "build and submit", or before any app-store push.

marketplace-publish

YAML-as-source-of-truth for releases across VS Code Marketplace + iOS App Store + Google Play. Triggers vsce + Expo EAS submit with the credentials you've staged in env.

When to use

Cutting a new release across one or more app surfaces
CI/CD release step (after version bump + git tag)
Audit-friendly publish records (every publish emits a splat in the hosted version)

How it works

Reads project metadata from package.json / app.json / eas.json
Pre-flight: validates the credentials for each target you've selected
Builds the package (vsce for VS Code; EAS for mobile)
Submits to the marketplace
Reports back the published version + URL

CLI

python3 marketplace_publish.py --target vscode             # dry-run
python3 marketplace_publish.py --target ios                # dry-run
python3 marketplace_publish.py --target android            # dry-run
python3 marketplace_publish.py --target all                # dry-run all three
python3 marketplace_publish.py --target vscode --apply     # real publish
python3 marketplace_publish.py --target all --apply        # ship to all three

Safety

--dry-run default
Pre-flight credential check before any destructive action
Per-target isolation (one failure doesn't block others)

Hosted version

Aria Code layers scheduled releases + team approval gates + release-notes pipeline on top.

License

Apache 2.0

marketplace-publish— agent skill

Is marketplace-publish safe to install?

marketplace-publish

When to use

How it works

CLI

Safety

Hosted version

License

Audit the pieces. Scan the whole. Decide.