
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
Deterministic textlint rules and CLI for catching prose slop in English Markdown.
Give it to your writing agent and it stops handing you AI-slop prose. Slopless is a deterministic linter - a textlint preset and a zero-config CLI - that flags the LLM tells (hollow framing, fake contrasts, hedging, em-dash tics, vacuous closers, and many more) so the agent rewrites until the text reads human. No model calls, no API key.
Given this paragraph of confident-sounding slop:
Let me be honest: in a world where everyone is racing to ship, most teams
forget the basics. We do not sell software. We sell outcomes. Everyone knows
the best products feel effortless. At the end of the day, the future belongs
to the teams that slow down to think.
npx slopless flags six findings across five rules - structure and rhetoric, not just a word list:
[slopless/boilerplate-framing] let me be honest
[slopless/prohibited-phrases] in a world where
[slopless/negation-reframe] We do not sell software. We sell outcomes.
[slopless/universalizing-claims] everyone knows
[slopless/cliches] at the end of the day
[slopless/prohibited-phrases] the future belongs to
Full JSON output is the default. See the Rules page for the complete inventory.
npm install -D slopless
npx slopless --help
npx slopless install-skill codex
npx slopless install-skill claude
Then start a fresh writing-agent session and tell it to use the Slopless skill:
Use the Slopless skill. Check this Markdown, rewrite the prose, and keep iterating until Slopless passes.
Loop:
npx slopless --help).The CLI bundles textlint, so it needs no separate textlint install and no .textlintrc. This is the recommended path for writing agents and one-off checks.
npm install -D slopless
npx slopless "docs/**/*.md"
Slopless is English-only. It requires a file path, glob, or stdin input. A bare npx slopless exits with code 2.
Exit 0 means clean. Exit 1 means findings. Exit 2 means failure.
Output is always JSON:
mkdir -p .slopless/findings
npx slopless "docs/**/*.md" > ".slopless/findings/$(date +%Y-%m-%d-%H%M%S)--review.json"
If you already run textlint, add slopless as a preset instead. It runs through your existing textlint, alongside your other rules and .textlintrc, and supports textlint's output formatters (the CLI is always JSON).
npm install -D slopless textlint
Add preset-slopless to your .textlintrc.json:
{
"rules": {
"preset-slopless": true
}
}
npx textlint "docs/**/*.md"
Findings use the same slopless/<rule> ids as the CLI. Turn off individual rules with "preset-slopless": { "cliches": false }. To honor the <!-- textlint-disable --> blocks below, also npm install -D textlint-filter-rule-comments and add "filters": { "comments": true } to the config.
Agents should run help first:
npx slopless --help
Agents should save raw JSON findings under .slopless/findings/ in the current working directory. Slopless does not choose redirected output filenames, slugs, or timestamps.
Install the Codex skill into the current repo:
npx slopless install-skill codex
Install the Claude Code skill into the current repo:
npx slopless install-skill claude
Both commands install the same slopless skill body. Start a new agent session after installing if the skill is not visible.
Use textlint comments around intentional exceptions:
<!-- textlint-disable slopless/semantic-thinness -->
Something shifted in the room.
<!-- textlint-enable slopless/semantic-thinness -->
textlint-disable block syntax.Every release since 0.2.13 is published from GitHub Actions via OIDC and carries a SLSA v1 provenance attestation recorded in the Sigstore transparency log.
npm audit signatures slopless
This confirms the tarball you installed was built in the published source repository's Actions environment, from the commit the GitHub Release points at.
Graham Rowe, thanks for giving me new ideas for classes of slop to detect. Your lib is now fully incorporated with your permission.
Developed by seochecks.ai to keep content specific, useful, and recognizably human.
FAQs
Deterministic textlint rules and CLI for catching prose slop in English Markdown.
We found that slopless demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.