release-npm-version — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release-npm-version (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
npm publish is irreversible after 72 hours and ships to everyone who installs the package. This card is the gate that catches the usual release breakers (missing dist, a CLI that won't start, an MCP server that won't speak stdio) before they reach users.
Before bumping the version and running npm publish.
npm run build (runs tsc + copies dashboard static assets).Zero errors.
npm test — all tests green. (test already runs build first.)npm pack to produce the tarball. Inspect its contents: tar -tzf claude-amplifier-<version>.tgzConfirm it includes dist/, README.md, CHANGELOG.md, CLAUDE.md, LICENSE, and examples/ — and excludes node_modules/, *.db, tests/, and source .ts. Match this against the files field in package.json.
(not the workspace), e.g.:
npm i -g ./claude-amplifier-<version>.tgz # or into a temp projectThis catches "works on my machine" issues (missing files, native better-sqlite3 rebuild problems).
claude-amplifier help and claude-amplifier doctorrun and print sane output from the installed binary.
(claude-amplifier mcp) and confirm it speaks MCP over stdio — e.g. it responds to a tools/list request and lists all expected tools. A server that builds but won't initialize over stdio is a broken release.
Changed). Keep the existing format.
package.json filesincludes dist, README.md, CLAUDE.md, LICENSE (and the prepublishOnly script will re-run build+test on publish).
npm publish. Publishing requiresthe maintainer's npm auth/2FA — if you are an agent, stop here and hand the final npm publish to the human.
Write a release check to:
./knowledge/release_check_{version}.mdIt must record: build result, test count + pass/fail, the tarball file list, the fresh-install result, CLI start output, MCP stdio tools/list result, and a final ✅/❌ go decision per step. A release proceeds only if every step is ✅.
npm pack + fresh-install check(the classic "forgot a file in files" release).
different entry paths.
npm publish itself instead of handing off theauth/2FA-gated final step.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.