
Research
/Security News
Laravel Lang Compromised with RCE Backdoor Across 700+ Versions
Laravel Lang packages were compromised with an RCE backdoor across hundreds of versions, exposing cloud, CI/CD, and developer secrets.
@avcodes/skilled
Advanced tools
Your AI coding tools keep traces. Skilled reads them.
Live TUI dashboard that aggregates skill usage across Claude Code, OpenCode, Codex, Grok, and Droid. Reads local history files only. Zero network, zero telemetry.
skilled list, skilled audit, skilled detail <skill>. Filter by source or project.Shell (Linux / macOS):
curl -fsSL https://raw.githubusercontent.com/av/skilled/main/install.sh | sh
npm:
npm install -g @avcodes/skilled
pip:
pip install skilled
Then run skilled.
skilled Interactive dashboard
skilled list All skills ranked by usage
skilled list --sort recent Sorted by last used
skilled detail review Deep dive on one skill
skilled audit Health report across all skills
skilled calls --source codex Raw invocations from a specific tool
skilled providers Which tools are detected
Add --json to any command for machine-readable output. Filter with --source <tool> and --project <path>.
| Key | Action |
|---|---|
s | Cycle sort: count → alphabetical → recent |
Tab | Toggle sort direction |
j / k | Scroll |
Enter | Open skill detail (replaces right panel) |
a | Toggle audit view |
r | Refresh data |
q / Esc | Quit |
| Tool | What it reads |
|---|---|
| Claude Code | ~/.claude/history.jsonl + session JSONL files |
| OpenCode | Local session history |
| Codex | Local session history |
| Grok | Local session history |
| Droid | Local session history |
Skilled auto-detects which tools are installed. No configuration needed. If the history files exist, they show up.
Each tool writes session traces to predictable local paths. Skilled has a provider for each one that parses those files and extracts skill invocations (slash commands, tool calls, skill triggers) into a common format: skill name, timestamp, project, session, source.
From there: frequency counts, weekly trends, hourly distribution, per-project breakdowns, and audit heuristics (rising = 50%+ increase over 4 weeks, stale = unused 30+ days, etc.).
The TUI renders at 30 fps using @opentui/core. Bar charts use 8-level Unicode block elements for sub-character precision. The heatmap uses a 5-level green intensity ramp.
No data leaves your machine. No accounts, no config files, no API keys.
Requires Bun:
git clone https://github.com/av/skilled.git
cd skilled
bun install
bun run start
Compile to a standalone binary:
bun run build # outputs ./skilled
For faster re-scanning of large history files:
cd index
cargo build --release
The TUI will use the index automatically when available.
MIT
FAQs
TUI dashboard for skill usage stats across AI coding tools
The npm package @avcodes/skilled receives a total of 204 weekly downloads. As such, @avcodes/skilled popularity was classified as not popular.
We found that @avcodes/skilled demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Laravel Lang packages were compromised with an RCE backdoor across hundreds of versions, exposing cloud, CI/CD, and developer secrets.

Security News
Socket found a malicious postinstall hook across 700+ GitHub repos, including PHP packages on Packagist and Node.js project repositories.

Security News
Vibe coding at scale is reshaping how packages are created, contributed, and selected across the software supply chain