
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@scoreflow/cli
Advanced tools
Scoreflow CLI — live XP + levels for AI-assisted work. OAuth device-flow login + Claude Code Stop hook.
Live XP + levels for AI-assisted work, surfaced in your terminal.
Companion CLI to Scoreflow — the teams-first scoring
product that measures AI craftsmanship (not volume). Install it once, run
scoreflow init, and a Claude Code Stop hook wires itself into your
~/.claude/settings.json. Every prompt shows a +X XP nudge, a level-up banner,
or an achievement unlock — right in the session.
npm install -g @scoreflow/cli
Requires Node.js 20+. Works on macOS, Linux, and WSL.
# 1. Sign up at https://scoreflow.dev/signup and grab your user token
scoreflow init
# 2. Work normally in Claude Code. After every response you'll see:
# +2 XP scoreflow (Level 3)
# 🏆 Level up! 3 → 4 Karpathy
# 🎖 Unlocked: First Session
| Command | Purpose |
|---|---|
scoreflow init | Interactive setup. Writes ~/.scoreflow/config.json and adds a Stop hook to ~/.claude/settings.json. |
scoreflow hook | Called by Claude Code after each response. Reads your progression, diffs against the cached snapshot, prints the delta. Silent on no-change. |
scoreflow status | One-shot readout: current level, XP, per-skill breakdown, progress to next level. |
scoreflow leaderboard | Global top 20 by cumulative XP. |
Scoreflow scores you across four components (bands, not monotones — gaming any of them collapses your score):
XP is derived from your daily CCS × streak multiplier × team multiplier. Allocated across 11 skill tracks (File Craft, Research, Automation, Agents, Writing, Analysis, Synthesis, Conversation, Teaching, Project Management, Creativity) based on your tool-call distribution that day.
MIT © Infinite Labs OÜ
FAQs
Scoreflow CLI — live XP + levels for AI-assisted work. OAuth device-flow login + Claude Code Stop hook.
The npm package @scoreflow/cli receives a total of 1 weekly downloads. As such, @scoreflow/cli popularity was classified as not popular.
We found that @scoreflow/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.