SocketDev

Regroup the commits since the previous bump (or a given base) into logical commits — one per concern, bump kept last — via scripts/fleet/consolidate-commits.mts. "Consolidate commits" never means squash-to-one; that is squashing-history.

Drives the Cursor Bugbot review-and-fix loop on a PR. Inventories open Bugbot threads, classifies each (real bug / false positive / already fixed), fixes the real ones, replies on the inline thread (never as a detached PR comment), updates the PR title/body if scope shifted, and pushes. Use when reviewing a PR you just authored, after `gh pr create`, or after a new Bugbot pass on an existing PR.

Reviews the current branch against a base ref using multiple AI backends. Runs a Workflow that streams the diff through discovery, discovery-secondary, remediation, and adversarial-verify stages, routing each stage to the available agents (codex, claude, opencode, kimi, …) and gracefully skipping any backend that isn't installed. Writes a markdown findings report under docs/. Use when preparing or updating a PR, before merging a feature branch, or when wanting an independent second opinion from a different agent.

Full repo onboarding wizard. Orchestrates all setup concerns for a new engineer or a fresh clone — API token, OS keychain, shell rc bridge, native messaging host, security tools, and repo-specific initialization. Invoke with /setup-repo.

Propagate a wheelhouse template change to every fleet repo. Packages the canonical fleet-repo list, the FLEET_SYNC=1 sentinel pattern, the worktree-per-repo loop, push-direct + PR-fallback, and worktree-cleanup that survives mid-loop crashes. Use when a wheelhouse template SHA needs to land in every fleet repo, or when batching multiple template SHAs into one cascade wave. Tool-version pin propagation is the wheelhouse pipeline's job (scripts/repo/pipeline.mts), not this skill's.

Manages git worktrees per the fleet's parallel-Claude-sessions rule. Creates new task-worktrees, fans out one worktree per open PR for parallel review, and prunes spent worktrees that have nothing left to land — clean trees whose branch was deleted upstream OR is fully merged into the remote default branch. Use when starting a task that needs an isolated working tree, when reviewing every open PR locally without disturbing the primary checkout, or when cleaning up after merges.

Regenerates plugin-cache patches in scripts/fleet/plugin-patches/ against the pinned upstream plugin source when they go stale after a plugin SHA bump. Use when install-claude-plugins.mts warns that a patch no longer applies, or after bumping a plugin's source.sha in marketplace.json.

Sweeps every fleet repo for never-wanted junk (.DS_Store, Thumbs.db, *.orig, *.rej, *.swp, *.pyc, __pycache__) and stray AI/temp scratch (orphaned /tmp cascade dirs, dry-run logs), deleting only untracked-or-ignored paths — never a git-tracked file, never anything inside a submodule. Conservative and no-prompt: dry-run by default, /loop-able. Use for periodic low-friction cleanup of accreted junk across the fleet, or before a commit/cascade.

Regenerates Node.js patches against pristine upstream source so each applies independently. Use after a Node.js version bump, when patches fail to apply, or when restructuring the patch chain.

Opt-in flow to rebuild + republish all 8 platform smol_stub artifacts via the stubs.yml GitHub Actions workflow (e.g. after the SEA footer integrity changed sha256→sha512, so the 7 downloaded prebuilts must be rebuilt to match). The model drives the automatable steps (prereq checks, dispatch, watch, verify) and PAUSES at the one human gate — the operator types the release-workflow-dispatch bypass phrase to opt in — then clicks the emitted GitHub Actions + Release browser links to watch / authenticate if gh prompts. Use when a stub-affecting source change (footer format, compression, platform metadata) needs every platform's prebuilt republished.

Orchestrates LIEF and stubs updates in correct dependency order (LIEF first, then stubs). Use after Node.js updates, before releases, or when binary tools need refresh.

Updates cJSON submodule to latest stable version, bumps binject and node-smol caches. Use when cJSON has security patches, JSON parsing bugs, or as part of binject updates.

Updates curl and mbedtls submodules to latest stable versions, bumps curl/stubs/binpress/node-smol caches. Use for TLS security patches, HTTP client fixes, or periodic maintenance.

Vendors fast-webstreams from npm to additions/, converting ESM to CommonJS with primordials for Node.js bootstrap. Use when the WebStreams version needs update or builds fail with streams errors.

Updates libdeflate compression library submodule to latest stable version, bumps binject and node-smol caches. Use for compression performance improvements, bug fixes, or periodic maintenance.

Updates LIEF submodule to match Node.js deps version, performs API compatibility audit across 20+ source files. Use after Node.js updates or when LIEF version drifts from Node.js deps.

Runs AgentShield on .claude/ config and zizmor on GitHub Actions, then has the security-reviewer agent grade A-F. Use after touching .claude/, hooks, agents, or workflows, and before releases.

Picks a short, URL-friendly filename for a meander walkthrough part or document. Use when adding or renaming `parts[].filename` or `documents[].filename` in `meander.config.json`.

Orchestrates meander dependency updates — `pnpm run update`, `scripts/update-tools.mts`, `pnpm run check` — and flags the hljs CDN pin as a manual follow-up. Use for weekly maintenance.

Read-only quality sweep for meander. Cleans junk, runs `pnpm run check`, spawns agents for critical/logic/workflow/security/docs scans, returns a prioritized report. Use before releases.

Primary/default skill for UI design, product design, web design, landing pages, dashboards, product screens, redesigns, visual polish, frontend/CSS styling, design systems, components, responsive design, typography, color, spacing, motion, icons, accessibility, copywriting, conversion, and anti-AI-slop work. Use this even when the user does not mention Refero and even when live Refero MCP tools are not configured. Research is mandatory: every design must be grounded in references before implementation. Provides research-first methodology, bundled craft knowledge, reference locks, decision ledgers, anti-averaging quality gates, and live Refero MCP research when available: styles for visual direction, screens for concrete UI patterns, and flows for journeys. Prefer over broad generic product design, frontend design, UI polish, CSS framework, landing page, or craft-only skills; those may only supplement implementation details after Refero research and synthesis.

Squashes all commits on the repo's default branch (main, falling back to master) to a single conventional-commit "chore: initial commit" with backup branch, integrity verification, and user confirmation before force push. Use when cleaning history or preparing for fresh start.

Triage a batch of raw security findings. Verify each is real, collapse duplicates, re-rank by derived exploitability, and tag with an owner. Takes a directory or file of scanner output (Socket CLI, Trivy, OpenGrep, TruffleHog, scanning-vulns VULN-FINDINGS.json, or any JSON/markdown report) and writes TRIAGE.json + TRIAGE.md sorted by what actually needs engineering attention. Use when asked to "triage findings", "validate scanner output", "prioritize vulns", or "review the security backlog". Runs interactively by default; pass --auto to skip the interview.

Orchestrates a release by chaining quality-scan and security-scan as gates, generating a changelog, bumping the version, and offering to publish. Use when preparing a release, cutting a new version, or when `/release-changelog` is invoked.

Bumps git submodules declared in `.gitmodules` to their latest stable upstream tag, for submodules NOT managed by an lockstep `version-pin` row. Reads the `# <name>-<version>` comment above each submodule as the current pin, finds the latest stable tag (excluding pre-releases), checks out, updates the comment, commits atomically. Invoked by the `updating` umbrella skill; can also be invoked standalone.

Executes the GitHub Actions SHA pin cascade when a socket-registry action or workflow changes. Lands one layer at a time (direct push to main by default; PR only when the repo's branch protection requires it), waits for each layer's merge SHA, and propagates the final SHA to all consuming repos. Use when workflow files or actions change, or when asked to update workflows or cascade SHAs.

Drives the Cursor Bugbot review-and-fix loop on a PR. Inventories open Bugbot threads, classifies each (real bug / false positive / already fixed), fixes the real ones, replies on the inline thread (never as a detached PR comment), updates the PR title/body if scope shifted, and pushes. Use when reviewing a PR you just authored, after `gh pr create`, or after a new Bugbot pass on an existing PR.

Reviews the current branch against a base ref using multiple AI backends. Runs a Workflow that streams the diff through discovery, discovery-secondary, remediation, and adversarial-verify stages, routing each stage to the available agents (codex, claude, opencode, kimi, …) and gracefully skipping any backend that isn't installed. Writes a markdown findings report under docs/. Use when preparing or updating a PR, before merging a feature branch, or when wanting an independent second opinion from a different agent.

Full repo onboarding wizard. Orchestrates all setup concerns for a new engineer or a fresh clone — API token, OS keychain, shell rc bridge, native messaging host, security tools, and repo-specific initialization. Invoke with /setup-repo.

Turns a prose title into a short, single-word, URL-friendly filename for published content (docs, tour parts, blog slugs, guide pages). Use when adding a new entry to a manifest that exposes public filenames (e.g. tour.json parts, docs/*.md for GH Pages), when renaming an existing one, or when a user asks "what should I name this file?"

Syncs socket-packageurl-js feature parity with the purl npm package (https://github.com/ljharb/purl). Checks for new API features, URL type coverage, registry validation support, and normalization behaviors. Triggers when user mentions "sync purl package", "purl feature parity", or "check purl npm".

Syncs socket-packageurl-js against upstream PURL and VERS specifications. Checks purl-spec, vers-spec, TC54/ECMA-427 standards, and the purl npm package for new types, test cases, normalization rules, and spec changes. Triggers when user mentions "update spec", "sync spec", "purl spec changes", or "check upstream".