Inspect npm package contents with list-npm-package-content

This guide treats the official Vercel list-npm-package-content skill as a review step before an npm release. It shows package contents but does not approve a release.

Prepare the workspace

Move into the actual package directory and review the build and packaging tools already used there. Keep the request limited to inspecting the artifact. Agree on network access and temporary files with the team. Secrets such as tokens, passwords, and private keys do not belong in prompts, packages, logs, or source control.

Understand the rules

Review the files field in package.json and any available exclusion files. Account for the standard files that the provider says are always included and the administration files that are always excluded. Then create the tarball and compare the actual file listing with the intended public package structure.

Handle differences

Missing runtime files, type definitions, or documentation indicate a configuration or build question. Unexpected test data, local configuration, debug output, or internal documents must be removed or explicitly approved before publication. Investigate the cause in the project rather than editing only the generated tarball.

Approval and boundaries

A file listing proves neither security nor correct behavior. Also review tests, license, provenance, dependencies, and maintainer approval. The skill can execute local scripts, so a responsible person must confirm the command, path, and result.

Frequently asked questions

### Does the skill list the content of the later npm download?

According to the provider, it shows the tarball contents that would be published and downloaded by users.

### Does the skill publish the package automatically?

No. It inspects the artifact. The decision and release process remain with the team.

### Are secrets required?

The described local inspection does not put secrets in the skill text or execution. Any project-specific access must be handled separately and securely.