secure-npm-package

# Release an npm package securely Set up a release process where no npm token exists to steal, releases can come only from one CI workflow, and every release still needs a manual approval with the maintainer's 2FA key. ## How to run this skill The setup is half repo files, half settings on npmjs.com and github.com that **only the user can change**. The settings are the part that needs the user, and if you do the repo changes first the instructions scroll past and get missed — so the user acts before you do. For the settings, produce click-by-click instructions with **direct links resolved from the repo's real data** — package names from `package.json`, owner/repo from the `repository` field — and the exact values to enter. Never say "go to your package settings"; always give the resolved URL. The order is strict — **questions, then manual settings, then CLI and files**: 1. **Gather facts** (Step 1), read-only and silent, to learn the project's shape. 2. **Ask all questions together.** Gather every decision you need from the user — cooldown length (1 or 3 days), whether to move build tools into `dependencies` for the `--omit=dev` hack in a monorepo, the `repository` field if it's missing, and anything else the project raises — and ask them all in one message. Do not drip questions out one at a time. Wait for the answers. 3. **Hand off the manual settings** (Step 2) on npmjs.com and github.com and ask the user to make every change. 4. **Wait for the user to confirm** they ...