Socket Security Skills

Socket Security Skills are definitions for dependency security tasks like vulnerability scanning, package review, patching, firewall configuration, and secure dependency updates. They follow the standardized Agent Skill format and are compatible with 40+ coding agent tools including:

• Claude Code (Anthropic) - native skill/plugin support
• Codex (OpenAI) - plugin with Socket account sign-in, Agent Skills standard, AGENTS.md fallback
• Gemini CLI (Google DeepMind) - extensions support
• OpenCode - skill directory support
• Cursor - plugin with skills, rules, and the Socket MCP server
• VS Code Copilot / GitHub Copilot - via AGENTS.md or Skills CLI
• Windsurf - via Skills CLI
• Roo Code - via Skills CLI
• Any agent supporting the Agent Skills standard - via pnpm dlx skills add

If your agent isn't listed above but supports skills, extensions, or custom instructions, it can likely use these skills via the Skills CLI or the agents/README.md fallback.

How do Skills work?

Skills are self-contained folders that package instructions, scripts, and resources for an AI agent to use on a specific task. Each folder includes a SKILL.md file with YAML frontmatter (name and description) followed by the guidance your coding agent follows while the skill is active.

Note

'Skills' is an Anthropic term from Claude AI and Claude Code; other agent tools use their own names for the same idea. OpenAI Codex uses the open Agent Skills format, where each skill is a directory with a SKILL.md file that Codex discovers from standard .agents/skills locations documented in the Codex Skills guide. Codex also works with an AGENTS.md file. Google Gemini uses 'extensions', defined in a gemini-extension.json file. This repo works with all of them.

If your agent doesn't support skills, use agents/README.md as a fallback: copy it into your project as AGENTS.md.

Install

Socket Security Skills are compatible with Claude Code, Codex, Gemini CLI, Cursor, and any agent supporting the Agent Skills standard.

Quick Install

Install skills using the Skills CLI (works with Claude Code, Codex, Gemini CLI, Cursor, and 40+ agents):

pnpm dlx skills add SocketDev/skills

To list available skills before installing:

pnpm dlx skills add SocketDev/skills --list

Claude Code

1. Register the repository as a plugin marketplace:

/plugin marketplace add SocketDev/skills

1. To install a skill, run:

/plugin install <skill-name>@SocketDev/skills

For example:

/plugin install socket-scan@SocketDev/skills

The installable plugin names are socket-connect, socket-setup, socket-scan, socket-scan-setup, socket-inspect, socket-fix, socket-dep-cleanup, socket-dep-patch, socket-dep-replace, and socket-dep-upgrade.

Codex

This repo is a Codex plugin marketplace. The socket-skills plugin bundles every skill and connects Codex to the hosted Socket MCP server. Codex signs in to the MCP server with your Socket account in the browser, so the MCP tools need no API token, and one sign-in covers every organization your account can see. The MCP tools look up package scores, alerts, the threat feed, and your organizations.

1. Add the marketplace:

   codex plugin marketplace add SocketDev/skills

2. Install the plugin. In the Codex TUI, run /plugins, select Socket, and install it. Codex opens your browser to sign in to Socket. From a shell, run:

   codex plugin add socket-skills@socket-skills

3. If you installed from a shell, or a Socket tool reports Authentication required, sign in to the MCP server:

   codex mcp login socket

   On a machine without a browser, such as over SSH, run codex mcp login socket --no-browser and paste the redirect URL back into the terminal. In the TUI, run /mcp login socket.

4. Start a new Codex session so it loads the plugin.

The scan and fix skills also run the Socket CLI, which signs in separately with socket login; the socket-connect skill walks through it. The hosted MCP server does not accept API tokens, so CI and other non-interactive codex exec runs use the CLI with SOCKET_CLI_API_TOKEN.

If you installed single-skill plugins such as socket-scan@socket-skills from this marketplace before, remove each one with codex plugin remove <name>@socket-skills before you install socket-skills. Otherwise Codex keeps the old copies, stops updating them, and loads each skill twice.

To use skills without the plugin, copy or symlink folders from skills/ into a standard .agents/skills location, as described in the Codex Skills guide. If your Codex setup relies on AGENTS.md, copy the generated agents/README.md into your project as AGENTS.md.

Gemini CLI

1. This repo includes gemini-extension.json to integrate with the Gemini CLI.

2. Install locally:

gemini extensions install . --consent

or use the GitHub URL:

gemini extensions install https://github.com/SocketDev/skills.git --consent

1. See Gemini CLI extensions docs for more help.

Cursor

This repository is a Cursor plugin. It gives Cursor:

• the skills in skills/
• the Socket MCP server at https://mcp.socket.dev/ (.cursor-plugin/mcp.json)
• a rule that tells the agent when to use the Socket MCP tools (.cursor-plugin/rules/)

Install from repository URL (or local checkout) via the Cursor plugin flow.

To connect to Socket, open Customize in the Cursor sidebar, find the Socket MCP server, and choose Authenticate. You sign in to Socket in the browser. You do not paste an API key. The skills that run the Socket CLI use their own sign-in (pnpm dlx socket login).

Warning

Some Cursor versions do not complete the OAuth sign-in for MCP servers that a plugin adds. The Socket tools then keep returning Unauthorized. See the Cursor forum report. If this occurs, use the skills, which sign in through the Socket CLI.

For contributors, regenerate manifests with:

node scripts/repo/publish.mts

OpenCode

This repository includes an .opencode/skills directory that OpenCode discovers automatically.

1. Clone or install this repo into your project
2. OpenCode will discover skills from .opencode/skills/

Or manually copy skill folders into your project's .opencode/skills/ directory.

Other Agents (VS Code Copilot, Windsurf, Roo Code, etc.)

For any agent that supports the Agent Skills standard or custom instructions:

1. Use the Skills CLI (recommended):

pnpm dlx skills add SocketDev/skills

1. Or manually copy the agents/README.md file into your agent's instructions/context directory as AGENTS.md. This file contains a summary of all available skills and their locations.

2. Skills call the Socket CLI and Batch PURL API directly, so no MCP server is required. The Claude Code, Cursor, and Gemini plugins also bundle the hosted Socket MCP server (https://mcp.socket.dev/), which signs you in through the browser instead of asking for an API key. See the socket-connect skill.

Usage

Documentation

• Best practices guide: recommended dependency security controls and CLI workflows.
• Skill catalog: descriptions and source links for each installable skill.
• Agent fallback bundle: instructions for agents that do not load skills directly.

This repository contains security-focused skills for dependency management. You can also contribute your own skills to the repository.

Available skills

The setup, analysis, and fix skill tables, each with its SKILL.md link

Setup

Install, authenticate, and configure Socket for your project.

Name	Description	Documentation
brew-publish	Operate the socket-release Homebrew tap flow - tap repo layout, formula bumps tied to published releases, and sha256 verification against the release's own checksums.txt.	SKILL.md
cargo-publish	Operate the socket-release crates.io flow - the cargo staged model, trusted publishing (OIDC), index-propagation waits, and yank-as-rollback.	SKILL.md
github-release	Cut, verify, and reconcile immutable GitHub releases - the registry-resolvability ORDER RULE, the draft-upload-undraft cut, checksums.txt, and tag-gap healing.	SKILL.md
npm-publish	Operate the socket-release npm flow end to end - bootstrap (permissive-then-staged-only publishing access), staged publish dispatch, soak, --approve promote, backfill, and rollback/deprecate.	SKILL.md
socket-connect	Connect to Socket by signing in through the browser - no API key to paste. Bundles the hosted Socket MCP server (OAuth), lists every organization you belong to, and links the Socket CLI for scans.	SKILL.md
socket-release	Stand up SocketDev publishing (npm, crates.io, GitHub releases, Homebrew tap) in a repo: copy in the release kit and run its bootstrap - name reservation, GitHub environments, npm trusted publisher, staged publish config, verification.	SKILL.md
socket-scan-setup	Set up prerequisites for Socket scanning - install the CLI, sign in with your own Socket account, and verify scan access.	SKILL.md
socket-setup	Set up Socket - connect your account through browser sign-in, install the CLI, configure policies and CI tokens, and set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems.	SKILL.md

Analysis

Scan dependencies and inspect individual packages for security risks.

Name	Description	Documentation
socket-inspect	Research a package before you depend on it - pull every signal from Socket (scores, alerts, malware verdicts, CVEs, supply-chain risk), check the socket.dev package page, evaluate alternatives, and surface available Socket patches.	SKILL.md
socket-scan	Run a full dependency scan using the Socket CLI. Creates a scan in the Socket dashboard, checks all dependencies for vulnerabilities and supply-chain risks, performs Tier 1 reachability analysis for enterprise customers, and provides license compliance auditing.	SKILL.md

Fix

Holistic dependency repair - orchestrate cleanup, replacement, patching, and upgrades in a single phased workflow with individual subskills for each operation.

Name	Description	Documentation
socket-dep-cleanup	Evaluate and remove a single unused dependency from your project. Searches the entire codebase for all usages (imports, requires, config refs, scripts, type packages, indirect usage), reports findings, and performs full removal with verification.	SKILL.md
socket-dep-patch	Apply Socket's binary-level security patches without changing dependency versions. Uses socket-patch apply to fix vulnerabilities in-place, then verifies automated patching is configured so patches persist across installs.	SKILL.md
socket-dep-replace	Replace a dependency with an alternative package, eliminate it via code rewrite, or use socket-optimize for optimized replacements.	SKILL.md
socket-dep-upgrade	Use socket fix to find and update vulnerable dependencies one at a time, then fix any breaking changes in the codebase. Security-audited upgrades with automated code migration.	SKILL.md
socket-fix	Fix dependency security issues - either scan and fix everything (requires /socket-scan), or target a single named package. Orchestrates /socket-dep-cleanup, /socket-dep-replace, /socket-dep-patch, and /socket-dep-upgrade as subskills.	SKILL.md

Best practices in practice

The skills pair with the enforcement layer around them: workflows, hooks, and the CLI commands that hold the same rules without an agent present.

• Soak time - no dependency younger than 7 days installs. minimumReleaseAge: 10080 in pnpm-workspace.yaml, and socket doctor adds or raises it on every run.
• sfw - sfw wraps the package manager so an install cannot pull a malicious package: sfw npm install, sfw pip install requests.
• socket optimize - the dependency-tree flows in order: origin fast-forward, pastoralist override audit, @socketregistry hardened overrides, dependency update, and the bundle-stub offer when the repo bundles with rolldown, esbuild, or rollup.

The full writeup with config and command examples is in docs/best-practices.md. Related project on the CI side: SocketDev/action (Socket in CLI or Firewall mode in CI).

Development

1. Create a new directory under skills/ with a descriptive name
2. Add a SKILL.md file with YAML frontmatter (name and description) followed by guidance content
3. Add an entry in .claude-plugin/marketplace.json with matching name and source path
4. Run node scripts/repo/publish.mts to regenerate all artifacts
5. Run node scripts/repo/publish.mts --check to verify everything is in sync
6. Submit a pull request

License

MIT