Menú
Socket.dev security scanning — check packages before installing, scan repos for supply chain risks. Auto-invoke when evaluating package safety, checking dependencies, or before installing new packages.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Use fff MCP / Grep / Read / Glob — never Bash grep/cat/find/head/tail/sed/awk/rg/wc — for file search and read. Use jq for JSON parsing/shaping (not node -e / python -c). A hook hard-blocks the banned Bash calls, and the dedicated tools return clean, cacheable, line-numbered results. Auto-invoke when searching, reading, or counting in files.
Planning and problem-solving discipline: enter plan mode first, write plans in the plan file (not chat), structured research, validation, implementation. Auto-invoke when the user says "plan", "make a plan", or when fixing issues or implementing features.
Use before any action: five-question self-check that catches destructive ops, scope creep, fabrication, premature completion, and ignored instructions. Auto-invoke before executing commands, editing files, or answering factual questions.
Reconcile skill collections, backport from ~/.claude/skills into a marketplace plugins tree, scrubbing proprietary refs. Use when local has diverged from upstream, or when promoting local-only skills to a marketplace.
Communication and scope discipline: how to interact with the user, handle rejection, stay in scope. Always active.
Final checklist before declaring any task complete. Auto-invoke before saying "done", "ready", "complete", or asking to commit/push.
| name | socket |
| description | Socket.dev security scanning — check packages before installing, scan repos for supply chain risks. Auto-invoke when evaluating package safety, checking dependencies, or before installing new packages. |
| user-invocable | true |
| argument-hint | <npm/package-name | scan> |
Use Socket to verify package safety before installing and to scan projects for supply chain risks.
The socket-mcp server is also available. Use its depscore tool for quick lookups when you only need the score without CLI output formatting.
socket npm/<package-name> --markdown
pnpm add.socket npm/<package>@<version> --markdown--json for raw data, --markdown for formatted output.Report these to the user:
fs, net, shell, eval, unsafe (benign in build tools, suspicious in utility libs)Decision guidance:
shell, eval, unsafe on a non-build-tool → flag it--json for detailssocket scan create --report
Creates a full scan of the project's dependencies and waits for the report.
--markdown for formatted output.--json for CI-friendly output.