Menu
Socket.dev security scanning — check packages before installing, scan repos for supply chain risks. Auto-invoke when evaluating package safety, checking dependencies, or before installing new packages.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use fff MCP / Grep / Read / Glob — never Bash grep/cat/find/head/tail/sed/awk/rg/wc — for file search and read. Use jq for JSON parsing/shaping (not node -e / python -c). A hook hard-blocks the banned Bash calls, and the dedicated tools return clean, cacheable, line-numbered results. Auto-invoke when searching, reading, or counting in files.
Planning and problem-solving discipline: enter plan mode first, write plans in the plan file (not chat), structured research, validation, implementation. Auto-invoke when the user says "plan", "make a plan", or when fixing issues or implementing features.
Use before any action: five-question self-check that catches destructive ops, scope creep, fabrication, premature completion, and ignored instructions. Auto-invoke before executing commands, editing files, or answering factual questions.
Reconcile skill collections, backport from ~/.claude/skills into a marketplace plugins tree, scrubbing proprietary refs. Use when local has diverged from upstream, or when promoting local-only skills to a marketplace.
Communication and scope discipline: how to interact with the user, handle rejection, stay in scope. Always active.
Final checklist before declaring any task complete. Auto-invoke before saying "done", "ready", "complete", or asking to commit/push.
| name | socket |
| description | Socket.dev security scanning — check packages before installing, scan repos for supply chain risks. Auto-invoke when evaluating package safety, checking dependencies, or before installing new packages. |
| user-invocable | true |
| argument-hint | <npm/package-name | scan> |
Use Socket to verify package safety before installing and to scan projects for supply chain risks.
The socket-mcp server is also available. Use its depscore tool for quick lookups when you only need the score without CLI output formatting.
socket npm/<package-name> --markdown
pnpm add.socket npm/<package>@<version> --markdown--json for raw data, --markdown for formatted output.Report these to the user:
fs, net, shell, eval, unsafe (benign in build tools, suspicious in utility libs)Decision guidance:
shell, eval, unsafe on a non-build-tool → flag it--json for detailssocket scan create --report
Creates a full scan of the project's dependencies and waits for the report.
--markdown for formatted output.--json for CI-friendly output.