
Product
Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
@gleanwork/configure-agents
Advanced tools
Scaffold and drift-check the gleanwork agent baseline (AGENTS.md, CLAUDE.md, skills/) across library and SDK repos
@gleanwork/configure-agents gives gleanwork library and SDK repos a consistent, AI-friendly setup and keeps it from drifting. It scaffolds a small baseline into a repo and drift-checks that baseline in CI. It also ships the authoring rubric that constrains how the per-repo skills are written.
skills/ (one directory per skill: skills/<name>/SKILL.md) that teaches a consuming AI how to use that library correctly, so we stop hand-feeding the same context. Distribution is handled by skills.sh fetching from GitHub — this tool owns none of it.Each opted-in repo gets:
AGENTS.md — the repo's real agent instructions.CLAUDE.md — a thin pointer to AGENTS.md.skills/<name>/SKILL.md — teaches a consuming AI to use the library; distributed via skills.sh..github/workflows/agent-baseline.yml — CI that runs the drift check on every PR.This repository ships agent skill(s) under skills/. Install them into your
AI agent with npx skills:
npx skills add -g gleanwork/configure-agents # global — available in every repo
npx skills add gleanwork/configure-agents # or scoped to the current repo
Once it's installed, ask your agent to onboard a repo (below) — you won't invoke the CLI by hand.
The intended path is AI-driven, through the configure-agents skill installed above. Ask the AI to onboard a repo; it will:
npx -y @gleanwork/configure-agents initskills/<name>/SKILL.md) against the rubric (the one rule below)npx -y @gleanwork/configure-agents checkEvery step is safe to re-run.
initScaffolds the baseline into the current repo. Idempotent: it creates missing files and never overwrites your content.
--lang <ts|python|go|java> — override language detection (otherwise detected from the repo's manifest)--package <name> — package name for the templates (defaults to the detected manifest name)--dryRun — show what would be created without writing anythingcheckVerifies the baseline structure and exits non-zero on violations (used by CI).
It checks, structurally only, that: the required files exist; at least one skills/<name>/SKILL.md exists, each with valid name/description frontmatter and the required sections; AGENTS.md has its required sections; and CLAUDE.md imports AGENTS.md. It does not — and cannot — validate that the skill's content is correct or current. That is the job of the rubric and of review.
migrateFor a repo set up before this baseline (e.g. a CLAUDE.md written by claude /init, with no AGENTS.md), promotes the existing CLAUDE.md into AGENTS.md and rewrites CLAUDE.md as a pointer. Ensures the required AGENTS.md sections; refuses if an AGENTS.md already exists (reconcile by hand). --dryRun previews. Run init to scaffold the rest, then refine the promoted AGENTS.md. init also detects this case and won't drop a competing stub.
A skill's value is the complement of the API surface. Whatever the language's authoritative, ships-with-the-code definition already expresses — signatures, parameters, enums, return shapes — reference it; never transcribe it. A copied fact rots on the next release; a pointer to the types never does.
| Language | Point the skill at |
|---|---|
| TypeScript / JS | the .d.ts referenced by types/exports in package.json |
| Python | inline type hints, .pyi stubs, the py.typed marker |
| Go | exported identifiers in source / godoc |
| Java | public classes and their Javadoc |
The full rubric — required shape, section-by-section guidance, pitfalls, and a worked example — lives in skills/configure-agents/SKILL.md.
See AGENTS.md.
FAQs
Scaffold and drift-check the gleanwork agent baseline (AGENTS.md, CLAUDE.md, skills/) across library and SDK repos
The npm package @gleanwork/configure-agents receives a total of 0 weekly downloads. As such, @gleanwork/configure-agents popularity was classified as not popular.
We found that @gleanwork/configure-agents demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 10 open source maintainers collaborating on the project.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.