$ ~/registry/skill/composiohq-composio-skills-npm-automation

SKILL

npm-automation

Name: npm-automation
Author: Composio

Automate NPM installs, scripts, and package management through Rube MCP.

Stars

★ 67,807

Source

GitHub

Updated

2026-07-15

// securityCaution

Prompt only, no code
Open source
Community-trusted· 64.7k

Summary

This skill appears to be an open-source prompt-style wrapper with strong community adoption. However, its documentation explicitly relies on remote Rube MCP and Composio NPM toolkit connections and can trigger external tool execution, so the overall posture is caution rather than high risk.

CredentialsCaution

The material claims 'No API keys needed,' but it also requires establishing an `npm` toolkit connection via `RUBE_MANAGE_CONNECTIONS` and following an auth link if the connection is not ACTIVE. This indicates credentials are likely handled in an external connection flow, creating ordinary third-party authorization and account-linking risks.

Network egressCaution

The README explicitly requires configuring `https://rube.app/mcp` as an MCP server and using Composio/Rube to search tools, manage connections, and execute workflows. User task content, session IDs, and tool arguments may be sent to these declared remote services, though the material does not define data-handling boundaries in detail.

Code executionCaution

This skill is not presented as a local executable installer, but its core purpose is to invoke remote tool execution through `RUBE_MULTI_EXECUTE_TOOL` and `RUBE_REMOTE_WORKBENCH` for NPM-related operations. That is a normal capability for such tooling; the material does not show requests for system privileges beyond its stated purpose or clear malicious execution red flags.

Data accessCaution

The documentation does not explicitly declare direct local file read/write access, but NPM automation commonly involves package data, project metadata, or workflow parameters. Combined with session reuse and the required memory parameter, the tool clearly processes some task context. No obvious overbroad permission is described, but the data scope and retention remain opaque.

Supply chainLow risk

Based on the provided facts, this skill comes from an open-source GitHub source and is associated with a repository showing high community adoption (64.7k stars). The material looks more like a README/prompt template than a closed-source binary. The license and maintenance status are unspecified, so verification is still advisable, but the available evidence generally lowers supply-chain risk.

Recommendations

Before connecting, verify Rube/Composio privacy policy, data retention, and authorization scope to avoid sending sensitive project information to remote tools.
Connect only a least-privilege NPM account, and prefer a test or restricted environment for the initial authorization flow.
Manually review the actual tool names and parameters returned by `RUBE_SEARCH_TOOLS` before execution to avoid issues from dynamic schemas or remote tool changes.
If you need stronger assurance, review the related MCP/tool source code and maintenance status before using it in production.

Audited by: gpt-5.4 · 2026-06-16

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "npm-automation" skill from askskill:
1. Download https://raw.githubusercontent.com/ComposioHQ/awesome-claude-skills/master/composio-skills/npm-automation/SKILL.md
2. Save it as ~/.claude/skills/npm-automation/SKILL.md
3. Reload skills and tell me it's ready

// download

Download SKILL.mdInstall manifest ↗

// docs

NPM Automation via Rube MCP

Automate NPM operations through Composio's NPM toolkit via Rube MCP.

Toolkit docs: composio.dev/toolkits/npm

Prerequisites

Rube MCP must be connected (RUBE_SEARCH_TOOLS available)
Active NPM connection via RUBE_MANAGE_CONNECTIONS with toolkit npm
Always call RUBE_SEARCH_TOOLS first to get current tool schemas

Setup

Get Rube MCP: Add https://rube.app/mcp as an MCP server in your client configuration. No API keys needed — just add the endpoint and it works.

Verify Rube MCP is available by confirming RUBE_SEARCH_TOOLS responds
Call RUBE_MANAGE_CONNECTIONS with toolkit npm
If connection is not ACTIVE, follow the returned auth link to complete setup
Confirm connection status shows ACTIVE before running any workflows

Tool Discovery

Always discover available tools before executing workflows:

RUBE_SEARCH_TOOLS
queries: [{use_case: "NPM operations", known_fields: ""}]
session: {generate_id: true}

This returns available tool slugs, input schemas, recommended execution plans, and known pitfalls.

Core Workflow Pattern

Step 1: Discover Available Tools

RUBE_SEARCH_TOOLS
queries: [{use_case: "your specific NPM task"}]
session: {id: "existing_session_id"}

Step 2: Check Connection

RUBE_MANAGE_CONNECTIONS
toolkits: ["npm"]
session_id: "your_session_id"

Step 3: Execute Tools

RUBE_MULTI_EXECUTE_TOOL
tools: [{
  tool_slug: "TOOL_SLUG_FROM_SEARCH",
  arguments: {/* schema-compliant args from search results */}
}]
memory: {}
session_id: "your_session_id"

Known Pitfalls

Always search first: Tool schemas change. Never hardcode tool slugs or arguments without calling RUBE_SEARCH_TOOLS
Check connection: Verify RUBE_MANAGE_CONNECTIONS shows ACTIVE status before executing tools
Schema compliance: Use exact field names and types from the search results
Memory parameter: Always include memory in RUBE_MULTI_EXECUTE_TOOL calls, even if empty ({})
Session reuse: Reuse session IDs within a workflow. Generate new ones for new workflows
Pagination: Check responses for pagination tokens and continue fetching until complete

Quick Reference

Operation	Approach
Find tools	`RUBE_SEARCH_TOOLS` with NPM-specific use case
Connect	`RUBE_MANAGE_CONNECTIONS` with toolkit `npm`
Execute	`RUBE_MULTI_EXECUTE_TOOL` with discovered tool slugs
Bulk ops	`RUBE_REMOTE_WORKBENCH` with `run_composio_tool()`
Full schema	`RUBE_GET_TOOL_SCHEMAS` for tools with `schemaRef`

Powered by Composio

Automate Prisma tasks via Rube MCP with schema-first tool discovery.

ComposioGet→

$ loading_