{"slug": "vlt-1-5-0-adds-agent-skills-management", "title": "vlt 1.5.0 Adds Agent Skills Management", "summary": "Vlt released version 1.5.0, adding a `vlt skills` command that discovers agent skill folders shipped inside installed JavaScript dependencies and links them into the directories coding agents such as Codex, Cursor, GitHub Copilot, and Gemini CLI read, defaulting to `.agents/skills`. The command pulls instructions from the package version recorded in the project's lockfile, saves selections as `allow-skills` in `vlt.json`, and keeps links updated on subsequent installs and `vlt ci` runs; when no selection is saved, `vlt skills link` defaults to `:not(:malware)`, using Socket's high-confidence malware alerts to exclude skills from flagged packages. The release follows vlt 1.0 in August, when the company shipped its stable package manager with hosted JavaScript registries and ecosystem mirrors.", "body_md": "# vlt 1.5.0 Adds Agent Skills Management\n\nvlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.\n\n- Sarah Gooding\n\nJavaScript packages increasingly ship instructions for coding agents alongside their code. But installing a package doesn’t necessarily put those instructions somewhere an agent will find them. Developers can end up copying skill files into their projects by hand, then having to keep those copies current as dependencies change.\n\n[vlt 1.5.0](https://www.vlt.io/blog/vlt-skills) brings that work into the package manager. Its new `vlt skills` command discovers skills in installed dependencies and links them into the directories coding agents read. The instructions come from the package version recorded in the project’s lockfile, and vlt keeps the links updated as dependencies change.\n\nThe release also extends vlt’s use of Socket security data to skills selection, giving developers a way to exclude skills from packages flagged as malware before making them available to their agents.\n\n## Agent instructions follow the installed package[#](#Agent-instructions-follow-the-installed-package)\n\nAn agent skill is a folder containing a `SKILL.md` file that tells a coding agent how to perform a task or work with a particular tool or library. A package can include those instructions in the same release as its code, but they ordinarily end up inside `node_modules`, outside the directories agents use to discover skills.\n\nAccording to the [vlt skills documentation](https://docs.vlt.io/client/commands/skills), the command only looks at packages already installed in the project. Developers install a dependency as usual, inspect the skills it provides, then choose which ones to link:\n\n```\nvlt install agent-browser\nvlt skills\nvlt skills link \"#agent-browser\"\n```\n\nThese commands:\n\n1. Install the package\n2. Lists available skills\n3. Links the skills supplied by `agent-browser` into the project’s agent directories\n\nBy default, vlt targets `.agents/skills`, which agents including Codex, Cursor, GitHub Copilot, and Gemini CLI read. It also detects agent folders at the project root and links into their skill directories, such as `.claude/skills` when a `.claude` folder is present. Developers can override the destinations with `skills-dir`.\n\nThe selection is saved as `allow-skills` in `vlt.json`. Once configured, subsequent installs and updates maintain the links, and `vlt ci` uses the saved configuration when a teammate clones the repository.\n\nThat ties the instructions to the dependency they describe. Updating the library updates the linked skills to those shipped with the new version, without a separate round of copying files. Developers can also select individual skills from a package using the new `:skill()` selector.\n\n## vlt uses Socket to filter out malicious packages[#](#vlt-uses-Socket-to-filter-out-malicious-packages)\n\nSkills give agents instructions that can influence how they use code, tools, and access. Linking is opt-in. When no selection is saved, running `vlt skills link` without a query defaults to `:not(:malware)`, using Socket’s high-confidence malware alerts to exclude skills from flagged packages.\n\nDevelopers can also build stricter filters using vlt’s [Socket-powered security selectors](https://docs.vlt.io/client/selectors/security-insights), excluding packages flagged for typosquatting, vulnerabilities, or obfuscated code. Those rules let teams control which dependencies can supply instructions to their coding agents.\n\n## vlt is expanding what a package manager handles[#](#vlt-is-expanding-what-a-package-manager-handles)\n\nThe skills release follows [vlt 1.0 in August](https://www.vlt.io/blog/1-0), when the company shipped its stable package manager alongside generally available hosted JavaScript registries and ecosystem mirrors. That release combined dependency queries, security controls, and registry infrastructure in a platform intended for both developers and agents.\n\nOne of its features separates downloading dependencies from running their install scripts. Developers can install packages first, then use `vlt build` to select which scripts may execute, with known malware blocked by default. Skills management takes a similar approach: installing a package and exposing its instructions to an agent are separate actions, governed by a saved selection.\n\nThe registry work addresses another part of the problem. vlt’s hosted services support existing npm-compatible clients while blocking known malicious packages in their infrastructure.\n\nEarlier this month, [pnpm 12.11.0](https://github.com/pnpm/pnpm/releases/tag/v12.11.0) added support for linking skills from direct dependencies after approval through `pnpm approve`. Managing agent instructions is becoming part of the job for JavaScript package managers.\n\nvlt’s approach combines that workflow with more granular selection and Socket filtering. Developers can choose individual skills within a package and use security queries to exclude packages flagged as malware, while keeping the instructions tied to installed dependency versions. That gives teams more control over which instructions reach their coding agents as dependencies change.", "url": "https://wpnews.pro/news/vlt-1-5-0-adds-agent-skills-management", "canonical_source": "https://socket.dev/blog/vlt-skills?utm_medium=feed", "published_at": "2026-10-21 02:27:15+00:00", "updated_at": "2026-10-21 05:47:21.873180+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-tools"], "entities": ["vlt", "Sarah Gooding", "Socket", "Codex", "Cursor", "GitHub Copilot", "Gemini CLI"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/vlt-1-5-0-adds-agent-skills-management", "markdown": "https://wpnews.pro/news/vlt-1-5-0-adds-agent-skills-management.md", "text": "https://wpnews.pro/news/vlt-1-5-0-adds-agent-skills-management.txt", "jsonld": "https://wpnews.pro/news/vlt-1-5-0-adds-agent-skills-management.jsonld"}}