Skills prpm-json-best-practices

📦

prpm-json-best-practices

Name: prpm-json-best-practices
Author: AgentWorkforce

Content revision r2 Safe 🌐 Network access📁 Filesystem access⚙️ External commands🔑 Env variables

Build Reliable PRPM Package Manifests

PRPM manifests are easy to misconfigure across packages, collections, and target formats. This skill guides consistent structure, metadata, paths, tags, scripts, and validation.

Supports: Claude Codex Code(CC)

🥉 77 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "prpm-json-best-practices" from https://skillstore.io/skills/agentworkforce-prpm-json-best-practices.md and its manifest at https://skillstore.io/api/skills/agentworkforce-prpm-json-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentworkforce-prpm-json-best-practices.md Signed manifest GET /api/skills/agentworkforce-prpm-json-best-practices/manifest Signed lockfile GET /api/skills/agentworkforce-prpm-json-best-practices/lockfile

Test it

Using "prpm-json-best-practices". Review my single Claude skill manifest before publishing.

Expected outcome:

Required metadata is complete.
Two file paths do not exist from the repository root.
Replace one uppercase tag with kebab-case.

Using "prpm-json-best-practices". Organize six packages from one repository.

Expected outcome:

The packages are grouped by privacy, format, and subtype. Duplicate names are renamed with clear format suffixes, and related versions remain synchronized.

Using "prpm-json-best-practices". Create a collection from existing PRPM packages.

Expected outcome:

The collection includes package identifiers, compatible version ranges, required flags, concise reasons, searchable tags, and complete repository metadata.

Security Audit

Safe

v9 • 7/23/2026 Open versioned report

All 280 static alerts are false positives after contextual review. URLs, paths, environment placeholders, shell snippets, and parent-directory navigation appear only in documentation or schema examples; Markdown backticks were misread as execution. No prompt injection, exfiltration intent, or executable skill code was found.

Files scanned

2,077

Lines analyzed

Review items

False positives ignored

Risk Factors

🌐 Network access (10)

examples/collections-repository.json:7 examples/multi-package.json:6 examples/packages-with-collections.json:5 examples/single-package.json:7 prpm-manifest.schema.json:2 prpm-manifest.schema.json:3 prpm-manifest.schema.json:111 prpm-manifest.schema.json:497 prpm-manifest.schema.json:586 SKILL.md:839

📁 Filesystem access (4)

prpm-manifest.schema.json:602 SKILL.md:904 SKILL.md:1250 SKILL.md:1175

⚙️ External commands (50)

🔑 Env variables (2)

SKILL.md:610 SKILL.md:668

No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/agentworkforce-prpm-json-best-practices/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentworkforce-prpm-json-best-practices/security.svg)](https://skillstore.io/skills/agentworkforce-prpm-json-best-practices?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentworkforce-prpm-json-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentworkforce-prpm-json-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentworkforce-prpm-json-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AgentWorkforce. (2026). prpm-json-best-practices security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/agentworkforce-prpm-json-best-practices/audits/9

BibTeX citation

@techreport{agentworkforce-agentworkforce-prpm-json-best-practices-2026,
  author = {AgentWorkforce},
  title = {prpm-json-best-practices security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/agentworkforce-prpm-json-best-practices/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "prpm-json-best-practices security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "AgentWorkforce"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentworkforce-prpm-json-best-practices/audits/9"
identifiers:
  - type: other
    value: "skillstore:agentworkforce-prpm-json-best-practices:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a First Manifest

Build a complete single-package manifest with required metadata, correct paths, tags, format, and subtype.

Organize a Package Repository

Structure related packages by privacy, format, and subtype while keeping names and versions consistent.

Publish Curated Collections

Define collections that reference local or external packages with versions, requirements, and inclusion reasons.

Try These Prompts

Create a Basic Manifest

Create a prpm.json manifest for my [format] [subtype] named [name]. Include these files: [paths]. Ask for missing required metadata.

Review an Existing Manifest

Review my prpm.json for required fields, path accuracy, tag format, duplicate names, semantic versions, and package versus lockfile mistakes.

Design a Multi-Package Manifest

Organize these packages into one PRPM manifest: [package details]. Group them by privacy, format, and subtype, then identify missing metadata.

Add Advanced Publishing Metadata

Extend my multi-package manifest with collections, eager settings, conversion hints, and prepublishOnly scripts. Explain each compatibility or execution concern.

Best Practices

Use project-root-relative paths and verify every referenced file before publishing.
Choose specific kebab-case names and three to eight searchable tags.
Use prepublishOnly for necessary builds and test every lifecycle command locally.

Avoid

Do not copy installed dependencies from prpm.lock into prpm.json.
Do not mix string paths and enhanced file objects in one files array.
Do not use absolute paths, duplicate package names, or unsynchronized related versions.