Agent Skill for LPM — teaches AI assistants how to create, publish, and manage LPM packages
SaferSkills independently audited lpm-guide (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Your guide for the entire LPM package lifecycle. Identify what the user needs from the table below, then read the linked section file for detailed instructions before proceeding.
LPM (lpm.dev) is a package registry. Packages use the format @lpm.dev/owner.package-name. Distribution modes:
| User Intent | Guide | When to read |
|---|---|---|
| Create a new package from scratch | Scaffold | "create package", "new package", "scaffold", "init" |
| Bring an existing npm package to LPM | Migrate | "migrate to lpm", "npm to lpm", "dual publish" |
| Check or improve package quality score | Improve | "improve quality", "quality score", "prepare for publish" |
| Make a source package configurable | Source Config | "lpm config", "make configurable", "lpm.config.json" |
| Choose Private, Pool, or Marketplace | Distribution | "distribution mode", "pool vs marketplace", "monetize" |
| Design Marketplace pricing and licensing | Pricing | "pricing strategy", "how much to charge", "license type" |
| Set up CI/CD for installing or publishing | Deploy | "deploy setup", "CI setup", "build fails 401", "LPM_TOKEN" |
| Evaluate a package before installing | Review | "review package", "is this safe", "compare packages" |
| Set up SPM to use LPM packages | Swift Registry | "swift registry", "SE-0292", "lpm swift-registry", "spm setup", "Package.swift registry", "swift package resolve" |
| Create or update Agent Skills for AI assistants | Skills | "agent skills", "create skills", "update skills", "lpm skills", ".lpm/skills" |
These are detailed specifications referenced by the section files:
| Reference | Used by |
|---|---|
| Quality Checks | Improve, Review |
| Config Spec | Source Config |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.