Guide · Agent skill

How to use the npm Registry Operations agent skill

Updated 2026-11-02 · written with AI from the project's own documentation and checked against our catalogue data

The npm agent skill is a set of instructions and helper scripts that lets an AI agent run common npm registry tasks for one maintainer account: checking who is logged in, checking whether a package name is free, reserving names and publishing a local package. This guide explains what the skill does, how to install it, how to ask for it in plain language and what to check before you rely on it. It is written for readers who have never used an agent skill before.

npm Registry Operationssteipete/agent-scripts · MIT Download the skill

Quick start

1Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
2Install the requirements. Make sure npm, node, tmux, op (1Password CLI) and jq are available on your machine.
3Prepare the 1Password item. Create or adapt the item 'npm Registry - steipete - Release Automation' in vault 'Molty' with registry_token and login fields, or edit the skill's paths and names to match your own vault.
4Ask for a status check. Request a check such as which npm account is logged in, to confirm the login works before any changes.
5Check a package name. Ask whether a package name is free. For scoped packages, confirm with npm access get status.
6Reserve or publish. Ask for reservation or publishing, providing a six-digit OTP when the helper asks for a fresh login.
7Run the offline tests. Run the offline regression tests from the repository root with an empty environment after any change.

What the npm skill makes the agent do

Once installed, the agent knows how to handle npm registry and account tasks. The skill's own description lists these areas: npm whoami, package availability, package reservation, publishing, org checks and auth debugging.

Credentials are meant to come from a 1Password item through helper scripts rather than being typed into the shell. Temporary npm config files are removed after each command.

Check which account is logged in (npm whoami)
Check whether a package name is available
Reserve names by publishing 0.0.0 placeholder packages with a generic README
Publish a local package, refusing an existing version
Run ad-hoc authenticated npm commands through a helper

Install the npm skill

Download the ZIP from this page and unzip it into one of two locations. For a personal install, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project.

If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.

Personal: unzip into ~/.claude/skills/
Project only: unzip into the project's .claude/skills/ folder
Claude apps: Settings → Capabilities → Skills, then upload

Meet the requirements before you start

The skill lists several tools it expects on your machine: npm, node, tmux, op (the 1Password CLI) and jq. It also needs a 1Password item named 'npm Registry - steipete - Release Automation' in a vault called 'Molty', with registry_token and login fields. For fresh logins, the agent needs a six-digit one-time password (OTP) from you.

The skill is written for one maintainer's setup. Its paths and item names are hard-coded to a specific author's machine, so you will likely need to edit them to match your own vault before the helpers work.

npm, node, tmux, op, jq installed
1Password item and vault matching the skill (or edited to match yours)
A six-digit OTP from you for fresh logins

Trigger the skill with natural requests

You do not need special syntax. Describe the npm task in plain words and mention npm, the registry or the package. The agent matches the request to the skill's instructions.

Ask for a status check before anything that changes the registry. The skill tells the agent to stop and ask if the 1Password item is missing, the account or vault is ambiguous, credentials look malformed, npm denies access, or the package version does not match the repo's release target.

"Check which npm account I'm logged in as."
"Is the package name my-tool free on npm?"
"Reserve these names with placeholder packages: package-one, package-two."
"Publish the package in this folder."

Publish and reserve package names

To publish, run the helper from the package root inside the shared auth tmux window. The helper verifies identity, refuses an existing version, publishes with a fresh OTP, retries one expired OTP and checks registry visibility, including restricted packages. It then cleans up auth files.

To reserve names, the reservation helper reads the release item once, reuses a stored session or logs in, publishes 0.0.0 placeholders, continues past individual failures and redacts tokens and OTPs in logs. If npm rejects a name as too similar to an existing package, treat that as a registry policy decision, not an authentication failure. For scoped packages, check npm access get status <pkg> because npm view can lag or return 404 even when the package exists.

/Users/steipete/Projects/agent-scripts/skills/npm/scripts/publish-package.sh
/Users/steipete/Projects/agent-scripts/skills/npm/scripts/reserve-packages.sh package-one package-two

Run the offline tests safely

The skill includes offline regression tests that use synthetic fixtures only, with no real 1Password or npm authentication. Run them from the repository root with an empty environment, because the shell mock checks its environment for token leaks.

test_home="$(mktemp -d)"
(
  set -e
  trap 'rm -rf "$test_home"' EXIT
  env -i HOME="$test_home" PATH="$PATH" node --test skills/npm/scripts/*.test.mjs </dev/null
  env -i HOME="$test_home" PATH="$PATH" /bin/bash skills/npm/scripts/npm-auth.test.sh </dev/null
)

Safety notes: scripts, network and credentials

This skill runs scripts and uses the network. It can publish to a public registry under a real account, so treat every publish as a real action. The skill says the agent should not run op directly in the shell, should keep npm auth in a temporary npmrc and should delete it afterwards. Desktop 1Password fallback is used only when you explicitly pass --account my.1password.com; an explicit release or publish request counts as consent for its unlock prompt.

The skill also says to use one task window in the shared op-work tmux session and not to create new sockets or sessions. If auth is unclear or npm whoami fails, the agent should stop and ask you for the exact field label or credential fix rather than probing more 1Password items.

Review the scripts before running them in your environment
Keep release credentials away from agents that should not publish
Expect the agent to stop and ask when something is ambiguous

Tips for getting reliable results

Name the exact package and version so the agent can compare them with the repo's release target. Use the helpers rather than hand-written npm login pipes, since the skill notes that npm 11 prompt piping is brittle. Keep the helper scripts' paths as they are unless you have updated them for your machine.

If you adapt the skill for your own account, change the hard-coded paths and the 1Password item and vault names, then run the offline tests before any live publish.

State the package name and version every time
Do not pipe prompts into npm login; use the helper path
Adapt paths and item names before first use
Run the offline tests after any edit

What people use it for

Confirming which npm account is active before a release
Checking whether a planned package name is still free on npm
Reserving several names with 0.0.0 placeholder packages
Publishing a local package after checking that its version is not already on the registry
Reviewing how a team handles registry tokens and OTPs in agent workflows

Frequently asked questions

How do I install the npm agent skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.

What do I need to run the npm skill?

You need npm, node, tmux, op (the 1Password CLI) and jq installed. You also need the 1Password item 'npm Registry - steipete - Release Automation' in the 'Molty' vault, with registry_token and login fields, plus a six-digit OTP for fresh logins.

Is the npm skill free to use?

The source lists the skill under the MIT licence. It does not state any price, so check the licence text included with the download for the terms.

Can I use it without the 1Password item?

Not as written. The skill says the helpers stop or fail without the matching item and vault, and its paths point to one author's machine, so you would need to edit the names and paths for your own setup.

Why does npm reject my package name?

The skill says npm may reject names it considers too similar to already-published names. Treat this as a registry policy result rather than an authentication problem.

Is it safe to let an agent publish to npm?

The skill can publish to a public registry under a real account, so only use it where agents are allowed to hold release credentials. It tries to keep credentials out of the shell, deletes temporary npmrc files and asks you to stop when something is ambiguous.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you maintain npm packages, already use the same 1Password vault layout, or want a scripted and auditable way to publish and reserve names. Pick something else if you lack the matching 1Password item, do not want agents holding release credentials, or plan to reserve many package names in bulk.

Download the skill