agentleFS
Sign inStart free
githubnextgithubnext/rig/.github/skills/npm/SKILL.md

npm

Skill14 starsChanged 20 days agoMITView on GitHub

Troubleshoot npm registry, proxy, and certificate failures on the Microsoft corporate network or VPN using the 1ES public npm feed.

7 other projects use a version of this.

Adopted by

Most recently taken up by

Used with

Projects with it also use frontend-design.

Other files people use alongside this one.

Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
  • BlockSkill

    frontend-design

    Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.

    Also in 3 projects that use this

  • Other versions7 projects use a version of this.

    Word for word · 1

    1. github/gh-aw★ 5.6k100% same

    Edited · 0

    None found.

    Wrote their own version · 6

    1. steipete/agent-scripts★ 7.4ksame name
    2. OpenHands/extensions★ 167same name
    3. G1Joshi/Agent-Skills★ 15same name
    4. NazmusSayad/skills★ 2same name
    5. DegreeSign/skills★ 1same name
    6. JakkuSakura/skills★ 1same name

    How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.

  • In this repository3 other files it gives its agents.

The file

We split this skill into the rules it gives an agent

6 rules. 0 are common, 2 are distinctive, and 4 are very specific to this project.

  • 0

    Common

    Most of the 6 edited versions we read keep these.

  • 2

    Distinctive

    This author's own choices. Worth a look.

  • 4

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Use this skill when npm downloads are blocked by the Microsoft corporate network or VPN.

    line 8
  2. Distinctive:

    When access to npmjs is blocked, retry through the Microsoft 1ES public feed with command-scoped settings:

    line 12
  3. Very specific:

    Use npm view, not npm ping: the feed may not implement the ping endpoint.

    line 28
  4. Distinctive:

    If the feed returns an authentication error or lacks the pinned package, report the blocker rather than guessing credentials or trying …

    line 30
  5. Very specific:

    Check whether an npm cafile override is selecting a different CA bundle.

    line 40
  6. Very specific:

    Keep HTTPS and TLS verification enabled.

    line 42

“Common” is measured: kept by at least 6 in 10 of the 6 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

npm on the Microsoft network or VPN

Use this skill when npm downloads are blocked by the Microsoft corporate network or VPN. Run commands in the affected package directory. Prefer npm ci with the existing lockfile and default registry when access works; do not change dependency versions to solve a network failure.

Use the 1ES public npm feed

When access to npmjs is blocked, retry through the Microsoft 1ES public feed with command-scoped settings:

registry=https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/
npm ci --registry="$registry" --replace-registry-host=npmjs

--replace-registry-host=npmjs routes npmjs lockfile downloads through the selected registry without rewriting the lockfile. Private registries and lifecycle scripts that download from other hosts still need their own approved network access. Do not edit manifests, lockfile URLs, or committed npm configuration just to work around the local VPN.

To diagnose feed access, query an actual package and exact version from the lockfile. For example, substitute the project's pinned package and version in:

npm view yaml@2.9.0 version --registry="$registry" \
  --fetch-retries=0 --fetch-timeout=15000

Use npm view, not npm ping: the feed may not implement the ping endpoint. A successful metadata query checks that package's availability, not tarball or postinstall access. Retry the original install to verify recovery.

If the feed returns an authentication error or lacks the pinned package, report the blocker rather than guessing credentials or trying arbitrary mirrors. Caching an upstream package can require feed permissions.

Proxy and certificate failures

The feed is an npm registry, not an HTTP proxy. Never set HTTPS_PROXY or HTTP_PROXY to the feed URL. If a forward proxy is required, use only an IT-approved proxy URL in the current shell and check NO_PROXY for unintended bypasses. Do not expose proxy credentials or copy machine-specific configuration into the repository or logs.

For certificate-chain errors, use the approved corporate CA rather than disabling TLS verification:

  • On Node versions that support it, retry with NODE_USE_SYSTEM_CA=1 so Node uses the system trust store.
  • Otherwise, set NODE_EXTRA_CA_CERTS to the path of an IT-provided PEM certificate bundle before starting npm.
  • Check whether an npm cafile override is selecting a different CA bundle.

Keep HTTPS and TLS verification enabled. Never use strict-ssl=false, NODE_TLS_REJECT_UNAUTHORIZED=0, curl -k, or an HTTP registry, and do not disconnect the VPN or bypass corporate network controls.

Stop on unresolved network failures

For ENOTCONN, connection resets, timeouts, or firewall denials, report the failing hostname and error with secrets redacted. Distinguish registry metadata, package tarball, and lifecycle-script failures. Stop repeated installs once the network blocker is confirmed; do not delete the lockfile or clear caches as a network fix. Escalate to IT for approved HTTPS access to the failing host, including ms-feed-25.pkgs.visualstudio.com when the feed itself is blocked.

Based on the githubnext/gh-aw-cao npm skill, under the repository's MIT license.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free