
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
agent-skill-loader
Advanced tools
Agent Skill Loader is a Model Context Protocol (MCP) server that acts as a bridge between your static Claude Code Skills library and dynamic AI agents (like Antigravity, Claude Desktop, or Cursor).
It allows agents to "learn" skills on demand without requiring you to manually copy files into every project.
list_skills - Scans your configured skill directories.read_skill - Fetches the SKILL.md content for the agent to read.install_skill - Copies the skill permanently to your project if needed.manage_search_paths - Add/remove skill directories at runtime.debug_info - Diagnose configuration and path issues.npm install
npm run build
.mcp.jsonAdd the minimal configuration to your global C:\Users\pc\.mcp.json (or project-specific config):
"agent-skill-loader": {
"command": "node",
"args": [
"<path-to-this-repo>/build/index.js"
]
}
The server automatically detects its workspace and aggregates skill paths from:
%USERPROFILE%\.claude\plugins\cache (Standard location)skill-paths.json (Located in the project root)You do not need to manually edit config files. Use the tool to manage paths at runtime:
manage_search_paths(operation="add", path="F:\\My\\Deep\\Skills")manage_search_paths(operation="remove", path="...")manage_search_paths(operation="list") creates/updates skill-paths.json.The agent will see five tools:
list_skills(): Returns a JSON list of available skills.read_skill(skill_name): Returns the markdown instructions.install_skill(skill_name, target_path?): Copies the folder to .agent/skills/<name>. For security, target_path must be within the current workspace.manage_search_paths(operation, path?): Add, remove, or list skill search paths.debug_info(): Returns diagnostic information (paths, status, warnings)."I need to write a DAX measure but I'm not sure about the best practices."
The agent will automatically call list_skills, find writing-dax-measures, call read_skill, and then answer you with expert knowledge.
If skills aren't being discovered, use debug_info() to see:
Example output:
{
"workspace_root": "C:/projects/agent-skill-loader",
"search_paths": {
"base": ["C:/Users/pc/.claude/plugins/cache"],
"dynamic": ["F:/My/Skills"],
"effective": ["C:/Users/pc/.claude/plugins/cache", "F:/My/Skills"]
},
"path_status": [
{ "path": "C:/Users/pc/.claude/plugins/cache", "exists": true, "readable": true },
{ "path": "F:/My/Skills", "exists": false, "readable": false }
],
"skills_found": 12,
"warnings": [
{ "path": "F:/My/Skills", "reason": "Directory does not exist" }
]
}
src/index.ts: Main server logic.build/: Compiled JavaScript output.package.json: Dependencies (@modelcontextprotocol/sdk, zod).To add new skills, simply add a folder with a SKILL.md file to one of the watched directories. The server picks them up automatically (no restart required for new files, though caching implementation may vary).
FAQs
MCP Server to expose Claude Code Skills to agents
The npm package agent-skill-loader receives a total of 34 weekly downloads. As such, agent-skill-loader popularity was classified as not popular.
We found that agent-skill-loader demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.