publish — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited publish (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Publish a package from this repo via GitHub release. Everything here is a compatibility shim over browser-web3-signer — releases should be rare, and only to keep an existing install working.
Arguments are optional and positional:
package: mcp-wallet-signer, browser-evm-signer, or browser-tron-signerbump: patch, minor, or majorInfer a missing package from git diff HEAD~3 --stat -- packages/; if ambiguous, ask.
version in packages/<package>/package.json (and version + packages[0].version inthe root server.json for mcp-wallet-signer, which the MCP registry reads).
npm test at the repo root — builds every package and runs each one's tests.gh release create <package>@<version> --title <package>@<version> --notes ….The publish.yml workflow parses the tag, checks the version matches the package.json, and publishes that one workspace.
Trusted publishing (OIDC) — there are no tokens in this repo. Each package lists provider GitHub Actions, owner nikicat, repo mcp-wallet-signer, workflow publish.yml, environment blank, under its npmjs.com "Access → Trusted Publishers". npm publish --provenance in the workflow authenticates through id-token: write and npm generates the provenance attestation.
Renaming publish.yml breaks this — update the trusted publisher on npmjs.com first, or the publish fails with ENEEDAUTH.
browser-evm-signer and browser-tron-signer used to publish to JSR as @nikicat/browser-*-signer. The shims are npm-only; the JSR packages are frozen at their last Deno release.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.