
Product
PHP and Composer Support Is Now in Beta
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.
SkillLens is a CLI tool that scans locally installed agent skills/tools, extracts redacted evidence, sends it to an auditor, and outputs a overview report.
Run once:
npx skilllens scan
pnpm dlx skilllens scan
Install globally:
pnpm add -g skilllens
skilllens scan
skilllens scan [path] [--auditor claude|codex]
skilllens config
scan uses scan.autoRoots from the config by default. Pass a path to scan a specific directory instead.
Scan output includes auditor CLI availability for claude and codex
skilllens scan creates a global config on first run:
~/.skilllens/config.jsonThe config includes:
auditor (defaults to the first available CLI)scan.autoRoots (default skill locations)Default scan roots:
~/.claude/skills~/.opencode/skills~/.codex/skillsSkillLens also seeds .codex/skills/.system plus common XDG config/data locations; adjust scan.autoRoots as needed.
To view the current config and its path:
skilllens config
Edit auditor or scan.autoRoots in the config file to change the CLI tool or add skill paths.
claude or codex.skipped.npm run lint
npm run smoke
FAQs
CLI that scans local agent skills/tools and produces security reports.
We found that skilllens demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

Research
/Security News
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.