
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
Observes how agent harnesses (Antigravity CLI, Claude Code, Codex CLI) load and activate Agent Skills. Node wrapper around the skillxp Go CLI.
Node wrapper around skillxp, a Go CLI that observes how agent harnesses (Antigravity CLI, Claude Code, Codex CLI) load and activate Agent Skills: it installs a skill in a fresh fixture, invokes the harness headlessly, and reports what actually reached the model, with transcript evidence.
Installing this package delivers the real Go binary for your platform via an optional dependency (no install scripts).
Windows is temporarily unavailable on npm (a registry naming issue is
being worked out with npm support); use the
PyPI package or a
release binary
with SKILLXP_BINARY in the meantime.
npx skillxp harnesses
npx skillxp observe -harness claude-code -install ./my-skill \
-prompt "Activate the my-skill skill and follow its instructions." \
-activation -trace "PHRASE-IN-BODY-1234" -out out/
Identical to the Go CLI — see the project README for the full surface and the observation bundle layout.
The CLI writes its results to disk (observation.json, session.json,
archived transcripts) rather than printing a JSON envelope, so this
package carries no invocation API. Spawn the CLI yourself and read the
bundle; binaryPath() exposes the bundled binary:
const { binaryPath } = require("skillxp");
const { execFileSync } = require("node:child_process");
execFileSync(binaryPath(), ["observe", "-harness", "claude-code", ...]);
Set SKILLXP_BINARY to override which binary the wrapper invokes.
FAQs
Observes how agent harnesses (Antigravity CLI, Claude Code, Codex CLI) load and activate Agent Skills. Node wrapper around the skillxp Go CLI.
The npm package skillxp receives a total of 10 weekly downloads. As such, skillxp popularity was classified as not popular.
We found that skillxp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.