Wheelshop
Security Notice
This extension includes AI agent skills that can modify AI assistant behavior. Review the skill files before installing.
Trust-gate auditor for npm/jsr packages used inside swamp extension models — agents pick candidates, wheelshop scores them against license, downloads, vulnerabilities, maintenance, and type-availability gates
DO NOT USE 2026.06.07.0 (yanked — bundled wrong source). 2026.06.07.1 ships the intended redesign. BREAKING vs 2026.05.04.x: search and audit removed. Use evaluate({ packages, runtime, unsafe }) — agents now own discovery and pick candidates from npm/jsr by reading descriptions; wheelshop only audits the list against trust gates (license, downloads, vulnerabilities, recency, types, maintainers). JSR is a first-class registry alongside npm via per-package registry field. Bundled swamp-wheelshop skill teaches the new agent-side flow.
Global Arguments
| Argument | Type | Description |
|---|---|---|
| cacheDir | string | Directory for the 24h fetch cache |
| cacheTtlHours | number | How long cached registry responses stay fresh, in hours |
| Argument | Type | Description |
|---|---|---|
| packages | array | Candidate packages to evaluate. Pick these yourself by searching npm/jsr and reading descriptions for semantic fit before calling. |
| runtime | enum | Target runtime — affects scoring; JSR candidates get a small boost when 'deno' or 'both' |
| unsafe | boolean | Mark every candidate approved even when blockers are present (DO NOT enable without explicit user approval) |
Resources
BREAKING: search and audit removed. Use evaluate({ packages, runtime, unsafe }) — agents now own discovery and pick candidates from npm/jsr by reading descriptions; wheelshop only audits the list against trust gates (license, downloads, vulnerabilities, recency, types, maintainers). JSR is a first-class registry alongside npm via per-package registry field. Bundled swamp-wheelshop skill teaches the new agent-side flow.
Added 1 skills
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned