技能 npm-git-install
📦
npm-git-install
內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數
從 Git 儲存庫安裝 npm 套件
團隊經常需要在套件發布到 npm 之前，先從分支、fork 或私有 GitHub 儲存庫取得套件。此技能說明 npm Git URL 格式、驗證選項、安裝檢查，以及常見修正方式。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "npm-git-install" from https://skillstore.io/skills/supercent-io-npm-git-install.md and its manifest at https://skillstore.io/api/skills/supercent-io-npm-git-install/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「npm-git-install」。 我需要從 GitHub 分支安裝套件。
預期結果:
助理會詢問儲存庫和分支，建議在正式環境固定標籤或提交，並提供簡潔的安裝命令。
正在使用「npm-git-install」。 我的私有 GitHub 套件在 npm install 期間失敗。
預期結果:
助理會將驗證檢查與套件建置檢查分開，然後建議 SSH、權杖和詳細記錄步驟。
正在使用「npm-git-install」。 全域 Git 套件命令在安裝後找不到。
預期結果:
助理會先檢查全域 npm prefix、套件 bin 項目、shell PATH 和安裝位置，再變更系統權限。
安全審計
高風險v6 • 2026/7/9 開啟版本化報告
This documentation-focused skill is not malicious, and many backtick detections are Markdown false positives. Remaining risks include GitHub package installs, lifecycle scripts, token authentication, .npmrc edits, global binary linking, and privileged troubleshooting commands.
2
已掃描檔案
388
分析行數
31
複核項目
0
已忽略的誤報
已確認的安全問題 (4)
高
NPM config file (may contain tokens)
### .npmrc Configuration
The skill includes .npmrc token configuration for GitHub access. .npmrc can contain package registry credentials, so this guidance is security-sensitive.
高
NPM config file (may contain tokens)
# ~/.npmrc
The skill includes .npmrc token configuration for GitHub access. .npmrc can contain package registry credentials, so this guidance is security-sensitive.
高
Unreviewed GitHub Package Lifecycle Execution
The skill teaches npm installs from GitHub and explains that npm runs prepare scripts and registers global binaries. Installing unreviewed Git repositories can execute package code during installation.
The document explicitly combines GitHub install commands with npm prepare-script and global binary behavior. This is a clear supply-chain execution risk even though it is presented as legitimate package management guidance.
高
Plaintext Git Credential Storage Guidance
The troubleshooting section recommends git credential.helper store for cached credentials. That helper can save credentials unencrypted on disk, creating a credential exposure risk.
The exact git credential.helper store command is present under credential caching. This is a known insecure storage option compared with OS keychain helpers.
能力複核項目 (31)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
sudo privilege escalation
sudo chown -R $(whoami) /usr/local/lib/node_modules
The command uses sudo to recursively change ownership under /usr/local/lib/node_modules. If followed without review, it changes system-owned package files and can weaken local integrity.
高
sudo privilege escalation
sudo apt-get install git
The command installs system packages with sudo apt-get. This is a common setup step, but it grants elevated privileges and should require explicit user confirmation.
高
Hardcoded URL
npm install git+https://<token>@github.com/owner/private-repo.git
The install URL includes a GitHub token placeholder, which can leak through shell history, process listings, npm logs, or copied package metadata. The context is legitimate private repo access but the pattern is sensitive.
高
Hardcoded URL
npm install git+https://${GITHUB_TOKEN}@github.com/owner/private-repo.git
The install URL includes a GitHub token placeholder, which can leak through shell history, process listings, npm logs, or copied package metadata. The context is legitimate private repo access but the pattern is sensitive.
高
Hidden file in home directory
# ~/.npmrc
The skill directs configuration in ~/.npmrc, a hidden file that commonly stores package registry credentials. Mishandling this file can expose tokens.
高
Hidden file in home directory
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc
The guidance modifies or sources ~/.bashrc, a persistent shell startup file. Changing startup files can affect future shell behavior and should be reviewed.
高
Hidden file in home directory
source ~/.bashrc
The guidance modifies or sources ~/.bashrc, a persistent shell startup file. Changing startup files can affect future shell behavior and should be reviewed.
高
Hidden file access
# ~/.npmrc
The .npmrc path is security-sensitive because it may contain registry or GitHub tokens. The nearby example configures token-based authentication.
高
Symlink creation
ln -s ../lib/node_modules/repo/bin/cli.js /usr/local/bin/repo
The example creates a symlink into /usr/local/bin, which can affect global command resolution. Although illustrative, this is a security-sensitive filesystem operation.
高
Git platform tokens
export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
The line handles GITHUB_TOKEN or passes it into npm/GitHub authentication. These values are secrets and can leak through logs, shell history, or configuration files if mishandled.
高
Git platform tokens
npm install git+https://${GITHUB_TOKEN}@github.com/owner/private-repo.git
The line handles GITHUB_TOKEN or passes it into npm/GitHub authentication. These values are secrets and can leak through logs, shell history, or configuration files if mishandled.
高
Git platform tokens
//github.com/:_authToken=${GITHUB_TOKEN}
The line handles GITHUB_TOKEN or passes it into npm/GitHub authentication. These values are secrets and can leak through logs, shell history, or configuration files if mishandled.
中
Shell command substitution
sudo chown -R $(whoami) /usr/local/lib/node_modules
The example uses $(whoami) inside a sudo chown command, so a shell expansion is performed before changing ownership. It is troubleshooting guidance, but it is still security-sensitive command execution.
中
Hardcoded URL
npm install -g git+https://github.com/JEO-tech-ai/supercode.git#main
The skill gives a concrete GitHub repository install or dependency example that fetches code from a moving branch. npm Git installs can execute package lifecycle scripts, so repository trust matters.
中
Hardcoded URL
npm install -g git+https://github.com/JEO-tech-ai/supercode.git#main --verbose
The skill gives a concrete GitHub repository install or dependency example that fetches code from a moving branch. npm Git installs can execute package lifecycle scripts, so repository trust matters.
中
Hardcoded URL
"supercode": "git+https://github.com/JEO-tech-ai/supercode.git#main",
The skill gives a concrete GitHub repository install or dependency example that fetches code from a moving branch. npm Git installs can execute package lifecycle scripts, so repository trust matters.
中
Hardcoded URL
npm install -g git+https://github.com/JEO-tech-ai/supercode.git#main
The skill gives a concrete GitHub repository install or dependency example that fetches code from a moving branch. npm Git installs can execute package lifecycle scripts, so repository trust matters.
中
SSH protocol URL
npm install -g git+ssh://git@github.com:JEO-tech-ai/supercode.git#main
The SSH Git URL is a real authenticated network install path for private or protected repositories. It is expected for the skill, but it depends on local SSH credentials and repository trust.
中
SSH protocol URL
"my-package": "git+ssh://git@github.com:owner/repo.git#v1.0.0",
The SSH Git URL is a real authenticated network install path for private or protected repositories. It is expected for the skill, but it depends on local SSH credentials and repository trust.
中
SSH protocol URL
npm install git+ssh://git@github.com:owner/private-repo.git
The SSH Git URL is a real authenticated network install path for private or protected repositories. It is expected for the skill, but it depends on local SSH credentials and repository trust.
中
Hidden file access
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc
The example writes to or sources ~/.bashrc, which changes user shell startup behavior. It is a common setup step but still needs user review.
中
Hidden file access
source ~/.bashrc
The example writes to or sources ~/.bashrc, which changes user shell startup behavior. It is a common setup step but still needs user review.
低
Hardcoded URL
npm install git+https://github.com/<owner>/<repo>.git#<branch|tag|commit>
The line documents a GitHub network operation used by the skill. This is expected functionality, but it still requires external network access and trust in the referenced repository.
低
Hardcoded URL
npm install git+https://github.com/owner/repo.git#v1.0.0
The line documents a GitHub network operation used by the skill. This is expected functionality, but it still requires external network access and trust in the referenced repository.
低
Hardcoded URL
npm install git+https://github.com/owner/repo.git#abc1234
The line documents a GitHub network operation used by the skill. This is expected functionality, but it still requires external network access and trust in the referenced repository.
低
Hardcoded URL
npm install git+https://github.com/owner/repo.git
The line documents a GitHub network operation used by the skill. This is expected functionality, but it still requires external network access and trust in the referenced repository.
低
Hardcoded URL
git clone https://github.com/owner/repo.git /tmp/npm-xxx
The line documents a GitHub network operation used by the skill. This is expected functionality, but it still requires external network access and trust in the referenced repository.
低
Hardcoded URL
npm install git+https://... --verbose 2>&1 | tee npm-install.log
The line documents a GitHub network operation used by the skill. This is expected functionality, but it still requires external network access and trust in the referenced repository.
低
Hardcoded URL
npm install -g git+https://...
The line documents a GitHub network operation used by the skill. This is expected functionality, but it still requires external network access and trust in the referenced repository.
低
Hardcoded URL
npm install -g git+https://github.com/owner/repo.git#main
The line documents a GitHub network operation used by the skill. This is expected functionality, but it still requires external network access and trust in the referenced repository.
低
Hardcoded URL
git ls-remote https://github.com/owner/repo.git HEAD
The line documents a GitHub network operation used by the skill. This is expected functionality, but it still requires external network access and trust in the referenced repository.
風險因素
⚙️ 外部命令 (50)
SKILL.md:28-30 SKILL.md:30-34 SKILL.md:34-46 SKILL.md:46-50 SKILL.md:50-52 SKILL.md:52-56 SKILL.md:56-58 SKILL.md:58-66 SKILL.md:66-78 SKILL.md:78-82 SKILL.md:82-91 SKILL.md:91-97 SKILL.md:97-110 SKILL.md:110-116 SKILL.md:116 SKILL.md:117 SKILL.md:118 SKILL.md:126-134 SKILL.md:134-138 SKILL.md:138-147 SKILL.md:147-155 SKILL.md:155-165 SKILL.md:165-169 SKILL.md:169-179 SKILL.md:179-183 SKILL.md:183-186 SKILL.md:186-194 SKILL.md:194-203 SKILL.md:203-207 SKILL.md:207-216 SKILL.md:216-220 SKILL.md:220-228 SKILL.md:228-232 SKILL.md:232-238 SKILL.md:238-242 SKILL.md:242-249 SKILL.md:249-257 SKILL.md:257-264 SKILL.md:264-268 SKILL.md:268-274 SKILL.md:274-278 SKILL.md:278-280 SKILL.md:280-288 SKILL.md:288-294 SKILL.md:294-298 SKILL.md:298-317 SKILL.md:317-325 SKILL.md:325-334 SKILL.md:334-377 SKILL.md:377
🌐 網路存取 (23)
📁 檔案系統存取 (20)
🔑 環境變數 (3)
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/supercent-io-npm-git-install/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/supercent-io-npm-git-install?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/supercent-io-npm-git-install?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supercent-io-npm-git-install/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/supercent-io-npm-git-install.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
supercent-io. (2026). npm-git-install security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/supercent-io-npm-git-install/audits/6BibTeX 引用
@techreport{supercent-io-supercent-io-npm-git-install-2026,
author = {supercent-io},
title = {npm-git-install security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/supercent-io-npm-git-install/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "npm-git-install security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "supercent-io"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/supercent-io-npm-git-install/audits/6"
identifiers:
- type: other
value: "skillstore:supercent-io-npm-git-install:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
69
社群
83
規範符合度
你可以打造什麼
安裝尚未發布的套件版本
當套件更新尚未發布到 npm 時，使用分支、標籤或提交參照。
使用私有 GitHub 套件
為內部儲存庫依賴項設定 SSH 或權杖式驗證。
疑難排解 Git URL 安裝
檢查安裝路徑、prepare 指令碼失敗、Git 可用性、快取問題和全域二進位檔。
試試這些提示
從 GitHub 安裝
協助我從 GitHub 儲存庫安裝 npm 套件。在提供命令前，請先詢問 owner、repo，以及分支或標籤。
固定依賴項
審查我的 npm Git 依賴項，並建議可讓安裝保持可重現的固定標籤或提交工作流程。
設定私有存取
引導我使用 SSH 或權杖式存取，從私有 GitHub 儲存庫安裝 npm 套件。
診斷安裝失敗
協助我診斷 npm Git 安裝失敗。請包含 Git、驗證、prepare 指令碼、快取和全域路徑的檢查。
最佳實務
- 將正式環境依賴項固定到標籤或提交，而不是會變動的分支。
- 從 GitHub 安裝前，請審查儲存庫可信度、套件指令碼和 lockfile 變更。
- 使用最小權限憑證，並避免讓權杖出現在命令歷史、記錄和套件檔案中。
避免
- 不要使用全域權限從未知儲存庫安裝。
- 不要將 personal access token 直接放入依賴項 URL。
- 在檢查更安全的 npm prefix 選項前，不要使用 sudo 或遞迴變更擁有權。
常見問題
這可以安裝尚未發布到 npm 的套件嗎？
可以。當套件具備有效的套件定義時，npm 可以直接從 GitHub 儲存庫安裝。
我應該在正式環境使用分支名稱嗎？
正式環境請使用標籤或提交。分支可能會移動，導致建置難以重現。
此技能會替我驗證私有儲存庫嗎？
不會。它會說明選項，但使用者必須自行管理 SSH 金鑰、權杖和權限。
Git URL 安裝可以執行套件指令碼嗎？
可以。npm 可以執行 prepare 等生命週期指令碼，因此安裝前請審查儲存庫。
是否必須全域安裝？
不需要。可行時請使用本機依賴項，且只對可信的命令列工具使用全域安裝。
哪些工具可以使用此技能？
報告列出對 Claude、Codex 和 Claude Code 的支援。
開發者詳細資訊
作者
supercent-io授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
維護新鮮度
2026/7/20
使用量
6 次下載 · 125 次瀏覽
檔案結構
📄 SKILL.md