
Product
Introducing Repository Access Permissions and Custom Roles
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.
@mastra/editor
Advanced tools
Affected versions:
This directory holds the builder agent's own playbooks: opinionated guides the Agent Builder reads at runtime when it needs to produce a high-quality agent of a given archetype (a coding agent, a spreadsheet agent, a research agent, etc.).
The word "skills" means two things in this codebase. Don't conflate them:
skill, skill_search, skill_read) wired up automatically because agent-builder-agent.ts configures a Workspace with skills: ['skills'].createSkillTool client tool. Persisted to the editor's skill store; surfaced via useAvailableSkills. These are not what lives in this directory.Builder authoring skills must never be attached to produced agents or mentioned to users. Produced agents can only reference user-facing capabilities that exist in the form snapshot.
At runtime the builder agent receives three workspace tools:
skill_search — find a skill by name/description.skill — activate a skill; returns the full SKILL.md content as a tool result.skill_read — read a specific file inside a skill directory (references, scripts, assets).The builder's system prompt (see ../agent-builder-agent.ts) instructs it to:
skill_search for that archetype.skill to activate it and load the playbook.If classification is uncertain, the builder falls back to agent-prompt-quality-bar (universal rules) and then generic-assistant.
Every archetype skill must help the builder instantiate this contract for the produced agent:
Without a run contract, the produced prompt will sound good but fail to finish real work.
Before the builder writes a produced system prompt, the prompt must pass this audit:
<...>, TBD, TODO, "policy here", "your tool").Coding:
Completion criteria: relevant files inspected; fix written; targeted test/typecheck run or explicit not-run reason; final response names changed files and behavior fixed.
Spreadsheet:
Completion criteria: write succeeded; affected range verified by read-back or returned updated values; final receipt states sheet, tab, range, row count, and skipped rows.
Research:
Completion criteria: current claims are searched; every finding has a citation; every numbered citation appears in the Sources list with date if available; "What I couldn't verify" is present.
Support:
Completion criteria: ticket classified; reply drafted or action verified; every policy claim grounded; refunds verified by tool result before claimed; internal note records classification and action.
Ops automation:
Completion criteria: idempotency key checked; action succeeded/skipped/failed/dry-run stopped; receipt includes idempotency key, affected resources, verification, status, and next run.
Every archetype SKILL.md follows this structure so the builder sees a consistent shape:
name (must match directory name; lowercase + hyphens), description (1024 chars max; includes the user-facing trigger words so skill_search ranks it correctly).<archetype>-agent/ (kebab-case, matches the name frontmatter field).SKILL.md following the internal template above.description field include the user-facing trigger words that would appear in a builder request. skill_search ranks by description; vague descriptions get skipped.*/SKILL.md files at agent-build time via the static skills: ['skills'] path in agent-builder-agent.ts.| Skill | When the builder picks it |
|---|---|
coding-agent | Writes, edits, reviews, or refactors source code. |
spreadsheet-agent | Reads or writes tabular data (Sheets, Excel, Airtable, CSV). |
research-agent | Researches a topic and produces a citation-backed report. |
customer-support-agent | Triages or replies to inbound support messages. |
content-writer-agent | Drafts blog posts, social, newsletters, marketing copy. |
ops-automation-agent | Runs recurring or event-driven internal automation. |
generic-assistant | Fallback for general-purpose personal helpers. |
agent-prompt-quality-bar | Meta-skill: universal run contract + final audit rubric. |
FAQs
Mastra Editor for agent management and instantiation
The npm package @mastra/editor receives a total of 27,936 weekly downloads. As such, @mastra/editor popularity was classified as popular.
We found that @mastra/editor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.

Product
Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.