{
  "markdown": "# Socket Security Skills\n\n[![Follow @SocketSecurity](https://img.shields.io/twitter/follow/SocketSecurity?style=social)](https://twitter.com/SocketSecurity)\n[![Follow @socket.dev on Bluesky](https://img.shields.io/badge/Follow-@socket.dev-1DA1F2?style=social&logo=bluesky)](https://bsky.app/profile/socket.dev)\n\nSocket Security Skills are definitions for dependency security tasks like vulnerability scanning, package review, patching, firewall configuration, and secure dependency updates. They follow the standardized [Agent Skill](https://agentskills.io/home) format and are compatible with **40+ coding agent tools** including:\n\n- **Claude Code** (Anthropic) - native skill/plugin support\n- **Codex** (OpenAI) - Agent Skills standard + AGENTS.md fallback\n- **Gemini CLI** (Google DeepMind) - extensions support\n- **OpenCode** - skill directory support\n- **Cursor** - plugin manifest support\n- **VS Code Copilot / GitHub Copilot** - via AGENTS.md or Skills CLI\n- **Windsurf** - via Skills CLI\n- **Roo Code** - via Skills CLI\n- **Any agent supporting the Agent Skills standard** - via `pnpm dlx skills add`\n\nIf your agent isn't listed above but supports skills, extensions, or custom instructions, it can likely use these skills via the [Skills CLI](https://skills.sh/) or the [`agents/README.md`](agents/README.md) fallback.\n\n## How do Skills work?\n\nSkills are self-contained folders that package instructions, scripts, and resources for an AI agent to use on a specific task. Each folder includes a `SKILL.md` file with YAML frontmatter (name and description) followed by the guidance your coding agent follows while the skill is active.\n\n> [!NOTE]\n> 'Skills' is an Anthropic term from Claude AI and Claude Code; other agent tools use their own names for the same idea. OpenAI Codex uses the open [Agent Skills](https://agentskills.io/specification) format, where each skill is a directory with a `SKILL.md` file that Codex discovers from standard `.agents/skills` locations documented in the [Codex Skills guide](https://developers.openai.com/codex/skills/). Codex also works with an `AGENTS.md` file. Google Gemini uses 'extensions', defined in a `gemini-extension.json` file. This repo works with all of them.\n\nIf your agent doesn't support skills, use [`agents/README.md`](agents/README.md) as a fallback: copy it into your project as `AGENTS.md`.\n\n## Install\n\nSocket Security Skills are compatible with Claude Code, Codex, Gemini CLI, Cursor, and any agent supporting the [Agent Skills standard](https://agentskills.io/specification).\n\n### Quick Install\n\nInstall skills using the [Skills CLI](https://skills.sh/) (works with Claude Code, Codex, Gemini CLI, Cursor, and 40+ agents):\n\n```shell\npnpm dlx skills add SocketDev/skills\n```\n\nTo list available skills before installing:\n\n```shell\npnpm dlx skills add SocketDev/skills --list\n```\n\n### Claude Code\n\n1. Register the repository as a plugin marketplace:\n\n```text\n/plugin marketplace add SocketDev/skills\n```\n\n1. To install a skill, run:\n\n```text\n/plugin install <skill-name>@SocketDev/skills\n```\n\nFor example:\n\n```text\n/plugin install socket-scan@SocketDev/skills\n```\n\nThe installable plugin names are `socket-setup`, `socket-scan`, `socket-scan-setup`, `socket-inspect`, `socket-fix`, `socket-dep-cleanup`, `socket-dep-patch`, `socket-dep-replace`, and `socket-dep-upgrade`.\n\n### Codex\n\n1. Copy or symlink any skills you want to use from this repository's `skills/` directory into one of Codex's standard `.agents/skills` locations (for example, `$REPO_ROOT/.agents/skills` or `$HOME/.agents/skills`) as described in the [Codex Skills guide](https://developers.openai.com/codex/skills/).\n\n2. Once a skill is available in one of those locations, Codex will discover it using the Agent Skills standard and load the `SKILL.md` instructions when it decides to use that skill or when you explicitly invoke it.\n\n3. If your Codex setup still relies on `AGENTS.md`, you can use the generated [`agents/README.md`](agents/README.md) file in this repo as a fallback bundle of instructions - copy it into your project as `AGENTS.md`.\n\n### Gemini CLI\n\n1. This repo includes `gemini-extension.json` to integrate with the Gemini CLI.\n\n2. Install locally:\n\n```text\ngemini extensions install . --consent\n```\n\nor use the GitHub URL:\n\n```text\ngemini extensions install https://github.com/SocketDev/skills.git --consent\n```\n\n1. See [Gemini CLI extensions docs](https://geminicli.com/docs/extensions/#installing-an-extension) for more help.\n\n### Cursor\n\nThis repository includes Cursor plugin manifests:\n\n- `.cursor-plugin/plugin.json`\n\nInstall from repository URL (or local checkout) via the Cursor plugin flow.\n\nFor contributors, regenerate manifests with:\n\n```bash\nnode scripts/repo/publish.mts\n```\n\n### OpenCode\n\nThis repository includes an `.opencode/skills` directory that OpenCode discovers automatically.\n\n1. Clone or install this repo into your project\n2. OpenCode will discover skills from `.opencode/skills/`\n\nOr manually copy skill folders into your project's `.opencode/skills/` directory.\n\n### Other Agents (VS Code Copilot, Windsurf, Roo Code, etc.)\n\nFor any agent that supports the Agent Skills standard or custom instructions:\n\n1. Use the Skills CLI (recommended):\n\n```shell\npnpm dlx skills add SocketDev/skills\n```\n\n1. Or manually copy the [`agents/README.md`](agents/README.md) file into your agent's instructions/context directory as `AGENTS.md`. This file contains a summary of all available skills and their locations.\n\n2. Skills call the Socket CLI and Batch PURL API directly, so no MCP server is required.\n\n## Usage\n\nThis repository contains security-focused skills for dependency management. You can also contribute your own skills to the repository.\n\n### Available skills\n\n<details><summary>The setup, analysis, and fix skill tables, each with its SKILL.md link</summary>\n\n<!-- This table is auto-generated by scripts/repo/generate-agents.mts. Do not edit manually. -->\n<!-- BEGIN_SKILLS_TABLE -->\n\n#### Setup\n\nInstall, authenticate, and configure Socket for your project.\n\n| Name                | Description                                                                                                                                                                                                                                 | Documentation                                             |\n| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |\n| `brew-publish`      | Operate the socket-release Homebrew tap flow - tap repo layout, formula bumps tied to published releases, and sha256 verification against the release's own checksums.txt.                                                                  | [SKILL.md](skills/socket-release/brew-publish/SKILL.md)   |\n| `cargo-publish`     | Operate the socket-release crates.io flow - the cargo staged model, trusted publishing (OIDC), index-propagation waits, and yank-as-rollback.                                                                                               | [SKILL.md](skills/socket-release/cargo-publish/SKILL.md)  |\n| `github-release`    | Cut, verify, and reconcile immutable GitHub releases - the registry-resolvability ORDER RULE, the draft-upload-undraft cut, checksums.txt, and tag-gap healing.                                                                             | [SKILL.md](skills/socket-release/github-release/SKILL.md) |\n| `npm-publish`       | Operate the socket-release npm flow end to end - bootstrap (permissive-then-staged-only publishing access), staged publish dispatch, soak, --approve promote, backfill, and rollback/deprecate.                                             | [SKILL.md](skills/socket-release/npm-publish/SKILL.md)    |\n| `socket-release`    | Stand up SocketDev publishing (npm, crates.io, GitHub releases, Homebrew tap) in a repo: copy in the release kit and run its bootstrap - name reservation, GitHub environments, npm trusted publisher, staged publish config, verification. | [SKILL.md](skills/socket-release/SKILL.md)                |\n| `socket-scan-setup` | Set up prerequisites for Socket scanning - install the CLI, configure auth with the public demo token, and verify scan access.                                                                                                              | [SKILL.md](skills/socket-scan/socket-scan-setup/SKILL.md) |\n| `socket-setup`      | Set up Socket - prompt for API key, install the CLI, authenticate, configure policies and tokens, set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems.                                             | [SKILL.md](skills/socket-setup/SKILL.md)                  |\n\n#### Analysis\n\nScan dependencies and inspect individual packages for security risks.\n\n| Name             | Description                                                                                                                                                                                                                                                            | Documentation                              |\n| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |\n| `socket-inspect` | Research a package before you depend on it - pull every signal from Socket (scores, alerts, malware verdicts, CVEs, supply-chain risk), check the socket.dev package page, evaluate alternatives, and surface available Socket patches.                                | [SKILL.md](skills/socket-inspect/SKILL.md) |\n| `socket-scan`    | Run a full dependency scan using the Socket CLI. Creates a scan in the Socket dashboard, checks all dependencies for vulnerabilities and supply-chain risks, performs Tier 1 reachability analysis for enterprise customers, and provides license compliance auditing. | [SKILL.md](skills/socket-scan/SKILL.md)    |\n\n#### Fix\n\nHolistic dependency repair - orchestrate cleanup, replacement, patching, and upgrades in a single phased workflow with individual subskills for each operation.\n\n| Name                 | Description                                                                                                                                                                                                                                            | Documentation                                             |\n| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------- |\n| `socket-dep-cleanup` | Evaluate and remove a single unused dependency from your project. Searches the entire codebase for all usages (imports, requires, config refs, scripts, type packages, indirect usage), reports findings, and performs full removal with verification. | [SKILL.md](skills/socket-fix/socket-dep-cleanup/SKILL.md) |\n| `socket-dep-patch`   | Apply Socket's binary-level security patches without changing dependency versions. Uses socket-patch apply to fix vulnerabilities in-place, then verifies automated patching is configured so patches persist across installs.                         | [SKILL.md](skills/socket-fix/socket-dep-patch/SKILL.md)   |\n| `socket-dep-replace` | Replace a dependency with an alternative package, eliminate it via code rewrite, or use socket-optimize for optimized replacements.                                                                                                                    | [SKILL.md](skills/socket-fix/socket-dep-replace/SKILL.md) |\n| `socket-dep-upgrade` | Use socket fix to find and update vulnerable dependencies one at a time, then fix any breaking changes in the codebase. Security-audited upgrades with automated code migration.                                                                       | [SKILL.md](skills/socket-fix/socket-dep-upgrade/SKILL.md) |\n| `socket-fix`         | Fix dependency security issues - either scan and fix everything (requires /socket-scan), or target a single named package. Orchestrates /socket-dep-cleanup, /socket-dep-replace, /socket-dep-patch, and /socket-dep-upgrade as subskills.             | [SKILL.md](skills/socket-fix/SKILL.md)                    |\n\n<!-- END_SKILLS_TABLE -->\n\n</details>\n\n### Best practices in practice\n\nThe skills pair with the enforcement layer around them: workflows, hooks, and the CLI commands that hold the same rules without an agent present.\n\n- **Soak time** - no dependency younger than 7 days installs. `minimumReleaseAge: 10080` in `pnpm-workspace.yaml`, and `socket doctor` adds or raises it on every run.\n- **sfw** - [`sfw`](https://github.com/SocketDev/sfw-free) wraps the package manager so an install cannot pull a malicious package: `sfw npm install`, `sfw pip install requests`.\n- **socket optimize** - the dependency-tree flows in order: origin fast-forward, pastoralist override audit, `@socketregistry` hardened overrides, dependency update, and the bundle-stub offer when the repo bundles with rolldown, esbuild, or rollup.\n\nThe full writeup with config and command examples is in [docs/best-practices.md](docs/best-practices.md). Related project on the CI side: [SocketDev/action](https://github.com/SocketDev/action) (Socket in CLI or Firewall mode in CI).\n\n## Development\n\n1. Create a new directory under `skills/` with a descriptive name\n2. Add a `SKILL.md` file with YAML frontmatter (`name` and `description`) followed by guidance content\n3. Add an entry in `.claude-plugin/marketplace.json` with matching `name` and `source` path\n4. Run `node scripts/repo/publish.mts` to regenerate all artifacts\n5. Run `node scripts/repo/publish.mts --check` to verify everything is in sync\n6. Submit a pull request\n\n## License\n\n[MIT](./LICENSE)\n",
  "bytes": 14389,
  "sha": "658e0056d9daf8588f38017aabf290f39312b6df773a4fa5ccbe6d114cd8292e",
  "repo_slug": "socketdev/sauce",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_socketdev_sauce_96ca2348/readme"
}