
Product
Microsoft Teams Notifications Are Now Available in Socket
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
@opvs-ai/skills
Advanced tools
opvsHUB Skill Factory + marketplace CLI — generate plugins from schema.yaml; publish / install / doctor signed marketplace packages
Skill Factory for opvsHUB — generates typed OpenClaw gateway plugins from schema.yaml API definitions.
# From the private OPVS registry
npm install @opvs-ai/skills --registry https://npm.opvs.ai
# Generate a single skill
opvs-skills generate agentboard --skills-dir ./skills --plugins-dir ./plugins
# Generate all skills
opvs-skills generate --all --skills-dir ./skills --plugins-dir ./plugins
# Generate all + bundle for gateway deployment
opvs-skills generate --all \
--skills-dir ./skills \
--plugins-dir ./plugins \
--bundle ./bundle/index.ts
# Generate all + MCP tool definitions
opvs-skills generate --all \
--skills-dir ./skills \
--plugins-dir ./plugins \
--mcp ./mcp/generated-tools.ts
opvs-skills validate --skills-dir ./skills
opvs-skills list --skills-dir ./skills
emit-runtime re-emits opvsHUB skills as runtime-native skill/rule
bundles for non-OpenClaw agent runtimes. Each runtime has its own
filesystem convention; the generator handles the path + frontmatter
shape per runtime.
| Runtime | Drop path inside --out | Frontmatter shape |
|---|---|---|
claude-code | .claude/skills/<prefix>-<name>/SKILL.md | name, description (per Claude Code skills) |
antigravity | .agent/skills/<prefix>-<name>/SKILL.md | name, description (per Antigravity skills codelab) |
cursor | .cursor/rules/<prefix>-<name>.mdc | description, alwaysApply (per Cursor rules) |
windsurf | .windsurf/rules/<prefix>-<name>.md (capped at 12,000 chars) | trigger, description (per Windsurf memories) |
# Emit a single skill for Claude Code
opvs-skills emit-runtime claude-code \
--skills-dir ./skills \
--out ./opvs-runtime-bundle/claude \
--skill vayapin
# Emit all skills for Cursor
opvs-skills emit-runtime cursor \
--skills-dir ./skills \
--out ./opvs-runtime-bundle/cursor
# Restrict to an allowlist
opvs-skills emit-runtime windsurf \
--skills-dir ./skills \
--out ./opvs-runtime-bundle/windsurf \
--allowlist vayapin,agentboard,opvs-foundation
# Dry-run (print what would be written without touching disk)
opvs-skills emit-runtime antigravity \
--skills-dir ./skills \
--out /tmp/scratch \
--dry-run
--prefix <prefix> controls the filename / directory prefix (default
opvs). The user drops the contents of --out into a target project
root to activate the skills.
End-to-end verification status (2026-05-15):
| Runtime | Status |
|---|---|
claude-code | Live-verified — fresh project + dropped bundle → claude --print discovers /opvs-vayapin, lists methods + env vars. Session log: tests/fixtures/e2e/claude-code-session.md |
cursor | Verified via Claude-equivalent rule-injection simulation — rule body fed as system prompt yields a correct, contextual answer. Session log: tests/fixtures/e2e/cursor-session.md |
windsurf | Format-level verified only — file lands at .windsurf/rules/, frontmatter parses, body kept under the 12k char cap. IDE-side activation untested (Windsurf is GUI-only). |
antigravity | Format-level verified only — file lands at .agent/skills/<slug>/SKILL.md, frontmatter matches the docs. IDE-side activation untested. |
From a single schema.yaml:
| Output | Purpose |
|---|---|
{skill}.ts plugin | TypeScript plugin with api.registerTool() calls — native LLM tools |
skills.yaml manifest | Tier 1 discovery index (one line per skill) |
index.ts bundle | All plugins merged into one file for gateway deployment |
generated-tools.ts | MCP tool definitions for the @opvs-ai/mcp server |
name: my-skill
version: "1.0.0"
description: What this skill does
category: utility
base_url: /api/v1/my-service
auth:
type: pat
header: Authorization
prefix: Bearer
env_var: OPVS_PAT
methods:
listItems:
description: List all items
http: GET /items
params:
status:
type: enum
values: [active, archived]
required: false
response:
format: yaml
See the opvsHUB repo for all skill schemas and full documentation.
import { generateFromSchema } from "@opvs-ai/skills";
const schemaYaml = fs.readFileSync("schema.yaml", "utf-8");
const result = generateFromSchema(schemaYaml);
// result.plugin — TypeScript plugin code
// result.manifest — skills.yaml entry
// result.skillMd — updated SKILL.md (if applicable)
check / fix)A.4 / A.6 in B1 Bundle 1 (2026-05-22) were both release-process bugs — agentboard_reorderColumns had a stale param shape and agentboard_updateColumn was missing from the published MCP entirely. Both were caused by schema.yaml drifting from the live FastAPI OpenAPI spec with nobody noticing until customer-facing tools 422'd.
opvs-skills check is the gate that prevents this from happening again. Point it at any FastAPI service's /openapi.json and it compares the live spec to your schema.yaml on a per-operation basis.
# Local smoke (boot the service first):
docker compose --profile queue up -d agentboard
sleep 20
opvs-skills check --skill agentboard --against http://localhost:8100/openapi.json
# Exit 1 on drift + structured report on stdout
# Exit 0 + "All schema methods match the live OpenAPI spec." when clean
# Against a checked-in OpenAPI export (no service boot needed):
opvs-skills check --skill agentboard --against ./openapi-agentboard.json
# JSON output for machine consumption:
opvs-skills check --skill agentboard --against http://localhost:8100/openapi.json --format json
# Skip known unbacked operations (e.g. routes intentionally not on the agent surface):
opvs-skills check --skill agentboard --against ... --ignore "GET /docs,GET /openapi.json"
The diff reports four drift classes per operation:
column_ids after the rename)columns after the rename)requiredPlus two operation-level diffs:
http: route the API doesn't exposeupdateColumn)fix — emit a hand-apply checklistopvs-skills fix --skill agentboard --against http://localhost:8100/openapi.json --out fix.md
fix deliberately does NOT mutate schema.yaml in place. Descriptions are hand-crafted and an automated rewrite risks stamping over them. The output is a markdown checklist with concrete per-field instructions you can copy into the YAML by hand.
The .github/workflows/tests.yml workflow runs opvs-skills check against three core services on every PR (agentboard, agentdocs, agentmemory). A drift report blocks merge until either the schema or the API is updated. This is the gate that catches A.4/A.6-class regressions before they hit npm publish.
FAQs
opvsHUB Skill Factory + marketplace CLI — generate plugins from schema.yaml; publish / install / doctor signed marketplace packages
We found that @opvs-ai/skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.