Skip to content

Repository navigation

feat(skills): add eight skills from the coding-agent skills spec #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Jordan Harband (ljharb) wants to merge 1 commit into
base: main
Choose a base branch
from
+2,091 −29
Open

feat(skills): add eight skills from the coding-agent skills spec #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions .claude-plugin/marketplace.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,61 @@
"description": "Set up prerequisites for Socket scanning - install the CLI, sign in with your own Socket account, and verify scan access.",
"dependencies": ["socket-connect"]
},
{
"name": "socket-firewall",
"source": "./skills/socket-firewall",
"skills": "./",
"description": "Run package installs through Socket Firewall (`sfw`) to block malware at download time, and handle a block when one happens. Use it when installing dependencies, when an install fails with a Socket block, or when setting up Enterprise policy and private registries.",
"dependencies": ["socket-connect"]
},
{
"name": "socket-pr-alerts",
"source": "./skills/socket-pr-alerts",
"skills": "./",
"description": "Triage the alerts Socket for GitHub posts on a pull request and decide what to fix, replace, or accept. Use it when a PR has a failing \"Socket Security\" check or a Socket alerts comment.",
"dependencies": ["socket-connect"]
},
{
"name": "socket-reachability",
"source": "./skills/socket-reachability",
"skills": "./",
"description": "Run Socket full application reachability analysis and read the .socket.facts.json report it writes. Use it to learn which vulnerabilities your code actually reaches, so you fix reachable CVEs first.",
"dependencies": ["socket-connect"]
},
{
"name": "socket-incident-response",
"source": "./skills/socket-incident-response",
"skills": "./",
"description": "Respond to a malware report or advisory about a package. Use it to confirm the report in Socket's threat feed, find out whether your projects use the bad version, contain it, check whether it ran, rotate secrets, and write up what happened.",
"dependencies": ["socket-connect"]
},
{
"name": "socket-policy",
"source": "./skills/socket-policy",
"skills": "./",
"description": "Edit a repository's socket.yml and change how Socket acts on alerts (block, warn, monitor, ignore). Use it to exclude paths from scans, tune the GitHub App per repo, check the file against the schema, or find and change the organization's security and license policy.",
"dependencies": ["socket-connect"]
},
{
"name": "socket-sbom",
"source": "./skills/socket-sbom",
"skills": "./",
"description": "Generate a CycloneDX SBOM for a project, export a CycloneDX or SPDX SBOM for an existing Socket scan, and check dependencies against the organization's license policy. Use it when someone asks for an SBOM, a bill of materials, or a license report.",
"dependencies": ["socket-connect"]
},
{
"name": "socket-vet-agent-tools",
"source": "./skills/socket-vet-agent-tools",
"skills": "./",
"description": "Vet an MCP server, agent skill, or plugin before you install it into a coding agent. Use it to check the packages behind it with Socket, read its published files, review its hooks, scripts, and prompt text, and install it pinned through Socket Firewall.",
"dependencies": ["socket-connect"]
},
{
"name": "knowledge-update",
"source": "./skills/knowledge-update",
"skills": "./",
"description": "Correct outdated model knowledge about Socket products - the CLI, Socket Firewall, the hosted MCP server, Socket for GitHub, reachability, socket.yml, and socket-patch. Read it before giving Socket advice from memory."
},
{
"name": "socket-release",
"source": "./skills/socket-release",
Expand Down
30 changes: 19 additions & 11 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ For example:
/plugin install socket-scan@SocketDev/skills
```

The installable plugin names are `socket-connect`, `socket-setup`, `socket-scan`, `socket-scan-setup`, `socket-inspect`, `socket-fix`, `socket-dep-cleanup`, `socket-dep-patch`, `socket-dep-replace`, and `socket-dep-upgrade`.
The installable plugin names are `socket-connect`, `socket-setup`, `socket-scan`, `socket-scan-setup`, `socket-inspect`, `socket-fix`, `socket-dep-cleanup`, `socket-dep-patch`, `socket-dep-replace`, `socket-dep-upgrade`, `socket-firewall`, `socket-pr-alerts`, `socket-reachability`, `socket-incident-response`, `socket-policy`, `socket-sbom`, `socket-vet-agent-tools`, and `knowledge-update`.

### Codex

Expand Down Expand Up @@ -184,16 +184,24 @@ This repository contains security-focused skills for dependency management. You

Install, authenticate, and configure Socket for your project.

| Name | Description | Documentation |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| `brew-publish` | Operate the socket-release Homebrew tap flow - tap repo layout, formula bumps tied to published releases, and sha256 verification against the release's own checksums.txt. | [SKILL.md](skills/socket-release/brew-publish/SKILL.md) |
| `cargo-publish` | Operate the socket-release crates.io flow - the cargo staged model, trusted publishing (OIDC), index-propagation waits, and yank-as-rollback. | [SKILL.md](skills/socket-release/cargo-publish/SKILL.md) |
| `github-release` | Cut, verify, and reconcile immutable GitHub releases - the registry-resolvability ORDER RULE, the draft-upload-undraft cut, checksums.txt, and tag-gap healing. | [SKILL.md](skills/socket-release/github-release/SKILL.md) |
| `npm-publish` | Operate the socket-release npm flow end to end - bootstrap (permissive-then-staged-only publishing access), staged publish dispatch, soak, --approve promote, backfill, and rollback/deprecate. | [SKILL.md](skills/socket-release/npm-publish/SKILL.md) |
| `socket-connect` | Connect to Socket by signing in through the browser - no API key to paste. Bundles the hosted Socket MCP server (OAuth), lists every organization you belong to, and links the Socket CLI for scans. | [SKILL.md](skills/socket-connect/SKILL.md) |
| `socket-release` | Stand up SocketDev publishing (npm, crates.io, GitHub releases, Homebrew tap) in a repo: copy in the release kit and run its bootstrap - name reservation, GitHub environments, npm trusted publisher, staged publish config, verification. | [SKILL.md](skills/socket-release/SKILL.md) |
| `socket-scan-setup` | Set up prerequisites for Socket scanning - install the CLI, sign in with your own Socket account, and verify scan access. | [SKILL.md](skills/socket-scan/socket-scan-setup/SKILL.md) |
| `socket-setup` | Set up Socket - connect your account through browser sign-in, install the CLI, configure policies and CI tokens, and set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems. | [SKILL.md](skills/socket-setup/SKILL.md) |
| Name | Description | Documentation |
| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| `brew-publish` | Operate the socket-release Homebrew tap flow - tap repo layout, formula bumps tied to published releases, and sha256 verification against the release's own checksums.txt. | [SKILL.md](skills/socket-release/brew-publish/SKILL.md) |
| `cargo-publish` | Operate the socket-release crates.io flow - the cargo staged model, trusted publishing (OIDC), index-propagation waits, and yank-as-rollback. | [SKILL.md](skills/socket-release/cargo-publish/SKILL.md) |
| `github-release` | Cut, verify, and reconcile immutable GitHub releases - the registry-resolvability ORDER RULE, the draft-upload-undraft cut, checksums.txt, and tag-gap healing. | [SKILL.md](skills/socket-release/github-release/SKILL.md) |
| `knowledge-update` | Correct outdated model knowledge about Socket products - the CLI, Socket Firewall, the hosted MCP server, Socket for GitHub, reachability, socket.yml, and socket-patch. Read it before giving Socket advice from memory. | [SKILL.md](skills/knowledge-update/SKILL.md) |
| `npm-publish` | Operate the socket-release npm flow end to end - bootstrap (permissive-then-staged-only publishing access), staged publish dispatch, soak, --approve promote, backfill, and rollback/deprecate. | [SKILL.md](skills/socket-release/npm-publish/SKILL.md) |
| `socket-connect` | Connect to Socket by signing in through the browser - no API key to paste. Bundles the hosted Socket MCP server (OAuth), lists every organization you belong to, and links the Socket CLI for scans. | [SKILL.md](skills/socket-connect/SKILL.md) |
| `socket-firewall` | Run package installs through Socket Firewall (`sfw`) to block malware at download time, and handle a block when one happens. Use it when installing dependencies, when an install fails with a Socket block, or when setting up Enterprise policy and private registries. | [SKILL.md](skills/socket-firewall/SKILL.md) |
| `socket-incident-response` | Respond to a malware report or advisory about a package. Use it to confirm the report in Socket's threat feed, find out whether your projects use the bad version, contain it, check whether it ran, rotate secrets, and write up what happened. | [SKILL.md](skills/socket-incident-response/SKILL.md) |
| `socket-policy` | Edit a repository's socket.yml and change how Socket acts on alerts (block, warn, monitor, ignore). Use it to exclude paths from scans, tune the GitHub App per repo, check the file against the schema, or find and change the organization's security and license policy. | [SKILL.md](skills/socket-policy/SKILL.md) |
| `socket-pr-alerts` | Triage the alerts Socket for GitHub posts on a pull request and decide what to fix, replace, or accept. Use it when a PR has a failing "Socket Security" check or a Socket alerts comment. | [SKILL.md](skills/socket-pr-alerts/SKILL.md) |
| `socket-reachability` | Run Socket full application reachability analysis and read the .socket.facts.json report it writes. Use it to learn which vulnerabilities your code actually reaches, so you fix reachable CVEs first. | [SKILL.md](skills/socket-reachability/SKILL.md) |
| `socket-release` | Stand up SocketDev publishing (npm, crates.io, GitHub releases, Homebrew tap) in a repo: copy in the release kit and run its bootstrap - name reservation, GitHub environments, npm trusted publisher, staged publish config, verification. | [SKILL.md](skills/socket-release/SKILL.md) |
| `socket-sbom` | Generate a CycloneDX SBOM for a project, export a CycloneDX or SPDX SBOM for an existing Socket scan, and check dependencies against the organization's license policy. Use it when someone asks for an SBOM, a bill of materials, or a license report. | [SKILL.md](skills/socket-sbom/SKILL.md) |
| `socket-scan-setup` | Set up prerequisites for Socket scanning - install the CLI, sign in with your own Socket account, and verify scan access. | [SKILL.md](skills/socket-scan/socket-scan-setup/SKILL.md) |
| `socket-setup` | Set up Socket - connect your account through browser sign-in, install the CLI, configure policies and CI tokens, and set up CI/CD for firewall or patch modes across GitHub, GitLab, Bitbucket, and other systems. | [SKILL.md](skills/socket-setup/SKILL.md) |
| `socket-vet-agent-tools` | Vet an MCP server, agent skill, or plugin before you install it into a coding agent. Use it to check the packages behind it with Socket, read its published files, review its hooks, scripts, and prompt text, and install it pinned through Socket Firewall. | [SKILL.md](skills/socket-vet-agent-tools/SKILL.md) |

#### Analysis

Expand Down
Loading
Loading