SocketDev

Propagate a wheelhouse template change across fleet repos: worktrees, push/PR fallback, cleanup.

Run this repo's GitHub Actions locally with Agent-CI before pushing CI-sensitive changes.

Audit package exports for dead, internal-only, or weakly-consumed subpaths before pruning.

Audit Actions permissions/allowlists against the fleet baseline; --conform fixes drift.

Turn the current conversation into a spec: problem, solution, stories, tests, enforcement.

Use red-green-refactor for a feature or bug fix when the user asks for test-first work.

Remove redundant CI workflows, stale Dependabot auto-fix surface, and obsolete workflow run clutter.

Turn repo rules that live only in prose or memory into scripts, hooks, lint rules, or checks.

Run this repo's GitHub Actions locally with Agent-CI before pushing CI-sensitive changes.

Audit Actions permissions/allowlists against the fleet baseline; --conform fixes drift.

Propagate a wheelhouse template change across fleet repos: worktrees, push/PR fallback, cleanup.

Turn repo rules that live only in prose or memory into scripts, hooks, lint rules, or checks.

Regroup commits since a base into logical commits, keeping any version bump last; not squash-to-one.

Reduce duplicate installs with overrides, hardened drop-ins, patches, consumer checks.

Route substantial work through plan, execute, review, follow-up agents at the right effort tier.

Designs and reviews accessible interfaces using reference research and rendered validation.

Act on `xport.json` lock-step drift: auto-bump `version-pin` rows; the other row kinds (file-fork, feature-parity, spec-conformance, lang-parity) are advisory only.

Fix dependency security issues - either scan and fix everything (requires /socket-scan), or target a single named package. Orchestrates /socket-dep-cleanup, /socket-dep-replace, /socket-dep-patch, and /socket-dep-upgrade as subskills.

Apply Socket's binary-level security patches without changing dependency versions. Uses socket-patch apply to fix vulnerabilities in-place, then verifies automated patching is configured so patches persist across installs.

Use socket fix to find and update vulnerable dependencies, then fix any breaking changes in the codebase. Security-audited upgrades with automated code migration.

Research a package before you depend on it - pull every signal from Socket (scores, alerts, malware verdicts, CVEs, supply-chain risk), check the socket.dev package page, evaluate alternatives, and surface available Socket patches.

Operate the socket-release npm flow end to end - bootstrap a package (name reservation, permissive-then-staged-only publishing access, trusted publishing), dispatch a staged publish, promote with --approve, backfill an old version, and roll back with…

Stand up SocketDev publishing (npm, crates.io, GitHub releases, Homebrew tap) in a repo - copy in the socket-release kit from a sauce checkout and run its bootstrap through name reservation, GitHub environments, npm trusted publisher, publishing-access…

Run a dependency scan using the Socket CLI. Prompts unauthenticated users to log in or create a free account. If the user skips login, falls back to cdxgen with greatly reduced alert accuracy and poor SBOM accuracy. Authenticated users get temporary read-only…

Create short, single-word, URL-friendly filenames from prose titles. Use when naming or renaming docs, guides, or slugs.

Sync feature parity with the upstream purl npm package. Use for purl parity, API coverage, registry validation, or normalization checks.

Sync against upstream PURL, VERS, and ECMA-427 specifications. Use for spec updates, upstream checks, or normalization changes.

Picks a short, URL-friendly filename for a meander part or document. Use when setting `parts[].filename` or `documents[].filename`.

Read-only quality sweep. Runs `pnpm run check`, spawns bug/logic/workflow/security/docs agents, returns a prioritized report.

AgentShield on .claude/ + zizmor on GitHub Actions, graded A-F by the security-reviewer agent.

Turn a repeated mistake into an enforcement artifact: hook, lint rule, script, or doctrine line.

Sync fleet inline-action ports to their upstreams' latest releases; advance portedAt on drift.

Write a handoff doc under .claude/reports and report its absolute path.

Syncs SHA-256 checksums from GitHub releases to bundle-tools.json. Triggers when user mentions "update checksums", "sync checksums", or after releasing new tool versions.

Regenerate plugin-cache patches against the pinned upstream plugin source after drift or SHA bumps.

Orchestrates a release: quality-scan + security-scan gates, changelog generation, version bump, and optional publish. Use when preparing or cutting a release.