Skills tsdown
📦
tsdown
Content revision r2 High Risk 🔑 Env variables⚙️ External commands📁 Filesystem access⚡ Contains scripts🌐 Network access
Bundle TypeScript Libraries with tsdown
Library builds often need multiple formats, declarations, and package validation. This skill guides tsdown configuration, migration, framework integration, and troubleshooting.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "tsdown" from https://skillstore.io/skills/antfu-tsdown.md and its manifest at https://skillstore.io/api/skills/antfu-tsdown/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "tsdown". Bundle a TypeScript library for Node.js and browser consumers.
Expected outcome:
- Recommended build: ESM and CommonJS outputs, declarations, source maps, and a clean distribution directory.
- Dependency plan: externalize declared peers and test both runtime targets before publication.
Using "tsdown". Migrate an existing tsup build with multiple entries.
Expected outcome:
- Migration summary: preserve entry patterns, formats, declaration generation, and external dependencies.
- Review list: verify renamed options, output extensions, cleaning behavior, and package exports.
Using "tsdown". Improve slow rebuilds in a component library.
Expected outcome:
Use watch exclusions for dependencies, build output, repository metadata, and tests. Consider disabling declaration generation during local watch sessions.
Security Audit
High Riskv5 • 7/23/2026 Open versioned report
Review confirmed eight findings covering compile-time environment-file loading and an automated release example that deletes output and publishes to npm. The remaining 158 detections are documentation, template literals, fixed local operations, or public links without malicious behavior. No prompt injection, exfiltration intent, or concealed execution was found.
42
Files scanned
9,061
Lines analyzed
3
Review items
0
False positives ignored
Confirmed security concerns (5)
High
Environment file access
tsdown --env-file .env.production
The documented env-file option loads .env.production into compile-time definitions; secrets in that file can be embedded in distributable output.
High
Environment file access
tsdown --env-file .env --env-prefix APP_ --env-prefix TSDOWN_
This command loads .env and exposes values under broad prefixes; a misclassified secret can be embedded in generated output.
High
Environment file access
tsdown --env-file .env.production --env.BUILD_TIME=$(date +%s)
The example loads .env.production for compile-time replacement, which can disclose secrets if sensitive variables are included.
High
Environment variant files
tsdown --env-file .env.production
The production environment file may contain credentials, and compile-time loading can copy those values into published bundles.
High
Environment variant files
tsdown --env-file .env.production --env.BUILD_TIME=$(date +%s)
The production environment file is explicitly loaded during a build, creating a real risk of embedding sensitive values in output.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Node.js child_process module
import { execSync } from 'child_process'
The release workflow imports child_process to run cleanup, tests, and publication commands; execution is intentional and includes destructive and external side effects.
High
Synchronous process execution
execSync('rm -rf dist')
The example runs rm -rf dist, a destructive shell command; an unexpected working directory or copied modification could remove unintended data.
High
Synchronous process execution
execSync('npm publish')
The npm publish command performs an authenticated external release with registry impact, and the example provides no confirmation or dry-run gate.
Risk Factors
🔑 Env variables (13)
references/advanced-ci.md:7 references/advanced-ci.md:7 references/advanced-hooks.md:172 references/advanced-hooks.md:243 references/advanced-hooks.md:172 references/advanced-hooks.md:243 references/advanced-plugins.md:176 references/advanced-plugins.md:176 references/advanced-programmatic.md:146 references/advanced-programmatic.md:294 references/advanced-programmatic.md:146 references/advanced-programmatic.md:294 references/reference-cli.md:228
⚙️ External commands (50)
references/advanced-hooks.md:40-44 references/advanced-hooks.md:101-109 references/advanced-hooks.md:136-145 references/advanced-hooks.md:159-163 references/advanced-hooks.md:189-193 references/advanced-hooks.md:205-209 references/advanced-hooks.md:209-214 references/advanced-programmatic.md:179 references/advanced-programmatic.md:234 references/advanced-programmatic.md:236 references/advanced-programmatic.md:184 references/advanced-programmatic.md:197 references/advanced-programmatic.md:201 references/option-css.md:75-86 references/option-css.md:95-102 references/option-css.md:102-105 references/option-minification.md:76-77 references/recipe-react.md:51-56 references/recipe-vue.md:85-104 references/reference-cli.md:447 SKILL.md:12 SKILL.md:16 SKILL.md:30-45 SKILL.md:45-49 SKILL.md:49-58 SKILL.md:58-70 SKILL.md:70 SKILL.md:74 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82 SKILL.md:83 SKILL.md:84 SKILL.md:85 SKILL.md:86-87 SKILL.md:87 SKILL.md:88 SKILL.md:89-90 SKILL.md:90-91 SKILL.md:91 SKILL.md:97-98 SKILL.md:98-99 SKILL.md:99-100 SKILL.md:100-107 SKILL.md:107-108 SKILL.md:108 SKILL.md:109-110 SKILL.md:110 SKILL.md:111 SKILL.md:112-113
📁 Filesystem access (7)
⚡ Contains scripts (2)
🌐 Network access (5)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/antfu-tsdown/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/antfu-tsdown?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/antfu-tsdown?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/antfu-tsdown/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/antfu-tsdown.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
antfu. (2026). tsdown security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/antfu-tsdown/audits/5BibTeX citation
@techreport{antfu-antfu-tsdown-2026,
author = {antfu},
title = {tsdown security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/antfu-tsdown/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "tsdown security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "antfu"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/antfu-tsdown/audits/5"
identifiers:
- type: other
value: "skillstore:antfu-tsdown:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 59
Architecture
85
Maintainability
87
Content
72
Community
83
Spec Compliance
What You Can Build
Publish a TypeScript library
Create ESM and CommonJS outputs, declarations, exports, and validation settings for an npm package.
Migrate from tsup
Translate existing build settings to tsdown and identify incompatible or renamed options.
Standardize monorepo builds
Define shared workspace builds, framework plugins, dependency rules, and CI checks across packages.
Try These Prompts
Create a basic library build
Create a tsdown configuration for [entry file]. Output ESM and CommonJS, generate declarations, and clean only the distribution directory.
Migrate a tsup configuration
Migrate this tsup configuration to tsdown: [configuration]. Preserve entries, formats, declarations, externals, and source maps. Explain unsupported options.
Configure a component library
Configure tsdown for a [framework] component library. Externalize framework peers, generate declarations, and include the required compiler plugin.
Design a guarded release build
Design a monorepo build for [packages]. Add workspace filters, CI validation, output checks, and a publication step requiring explicit confirmation.
Best Practices
- Inspect the existing package manifest, runtime targets, and peer dependencies before creating a configuration.
- Keep output in a dedicated directory and validate the resolved path before cleaning.
- Test packed artifacts on every supported runtime before publishing.
Avoid
- Do not set the output directory to the project root while cleaning is enabled.
- Do not bundle framework peer dependencies unless consumers require embedded copies.
- Do not load secret environment values into compile-time definitions.
Frequently Asked Questions
Does this skill install or run tsdown automatically?
No. It provides guidance. Package installation and build commands run only when the user or agent executes them.
Which Node.js version is required?
tsdown requires Node.js 22.18.0 or newer to build. Generated packages can target older Node.js versions.
Can it migrate a tsup configuration?
Yes. It maps common settings and identifies options that require manual adjustment.
Does it support component libraries?
Yes. The references cover React, Vue, Solid, and Svelte integration patterns.
Can it generate TypeScript declarations?
Yes. It covers declaration generation, declaration source maps, compiler options, and framework-specific settings.
How should environment values be handled?
Use explicit prefixes, exclude secrets, keep environment files unpublished, and inspect generated bundles for embedded values.
Developer Details
Author
antfuLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
89edfdc710d0846129dcee6a929477b04f08052c
Maintenance freshness
7/24/2026
Usage
9 downloads · 353 views
File structure