Pkg Peek

Package Peek (inspect without installing)

Look inside a published package's archive — files, README, changelog — to sanity-check it before adoption or to understand what changed.

Tooling

ecosystems CLI with --format json and --mailto "$ECOSYSTEMS_MAILTO" for polite-pool access (email configurable via the ECOSYSTEMS_MAILTO env var; a harmless no-op if unset). The archives commands operate on a --url pointing at the package tarball/archive.

Step 1 — Find the archive (download) URL

Get package metadata and pull the registry download URL for the version you care about:

ecosystems packages get_registry_package --purl "pkg:npm/lodash" --format json
ecosystems packages get_registry_package_version --purl "pkg:npm/lodash@4.17.21" --format json

Use the download_url (or equivalent tarball link) from that output as ``.

Step 2 — Inspect the archive

# List files (spot suspicious/unexpected content, install scripts, binaries)
ecosystems archives list --url "" --format json

# README
ecosystems archives readme --url "" --format json

# Changelog (what changed)
ecosystems archives changelog --url "" --format json

# A specific file's contents (requires --path)
ecosystems archives contents --url "" --path "package.json" --format json

# Repopack: a single bundled view of the repo, handy for review/LLM context
ecosystems archives repopack --url "" --format json

Step 3 — Diff two versions (optional)

To see what changed between releases, fetch both versions' archive URLs (step 1) and:

ecosystems diff create_job "" "" --polling-interval 2 --format json

Report

Summarise what's actually in the package: entry points, notable files, anything surprising (postinstall scripts, prebuilt binaries, telemetry), and a short README/changelog digest. If reviewing for safety, flag anything that doesn't match the package's stated purpose. Related: [[dep-vet]] for the full adoption scorecard.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: sebs
• Source: sebs/claude-ecosystems-skills
• License: MIT

Install and usage instructions live in the source repository linked above.