vlt 1.5.0 Adds Agent Skills Management

Vlt released version 1.5.0, adding a `vlt skills` command that discovers agent skill folders shipped inside installed JavaScript dependencies and links them into the directories coding agents such as Codex, Cursor, GitHub Copilot, and Gemini CLI read, defaulting to `.agents/skills`. The command pulls instructions from the package version recorded in the project's lockfile, saves selections as `allow-skills` in `vlt.json`, and keeps links updated on subsequent installs and `vlt ci` runs; when no selection is saved, `vlt skills link` defaults to `:not(:malware)`, using Socket's high-confidence malware alerts to exclude skills from flagged packages. The release follows vlt 1.0 in August, when the company shipped its stable package manager with hosted JavaScript registries and ecosystem mirrors.

vlt 1.5.0 Adds Agent Skills Management vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages. - Sarah Gooding JavaScript packages increasingly ship instructions for coding agents alongside their code. But installing a package doesn’t necessarily put those instructions somewhere an agent will find them. Developers can end up copying skill files into their projects by hand, then having to keep those copies current as dependencies change. vlt 1.5.0 https://www.vlt.io/blog/vlt-skills brings that work into the package manager. Its new vlt skills command discovers skills in installed dependencies and links them into the directories coding agents read. The instructions come from the package version recorded in the project’s lockfile, and vlt keeps the links updated as dependencies change. The release also extends vlt’s use of Socket security data to skills selection, giving developers a way to exclude skills from packages flagged as malware before making them available to their agents. Agent instructions follow the installed package Agent-instructions-follow-the-installed-package An agent skill is a folder containing a SKILL.md file that tells a coding agent how to perform a task or work with a particular tool or library. A package can include those instructions in the same release as its code, but they ordinarily end up inside node modules , outside the directories agents use to discover skills. According to the vlt skills documentation https://docs.vlt.io/client/commands/skills , the command only looks at packages already installed in the project. Developers install a dependency as usual, inspect the skills it provides, then choose which ones to link: vlt install agent-browser vlt skills vlt skills link " agent-browser" These commands: 1. Install the package 2. Lists available skills 3. Links the skills supplied by agent-browser into the project’s agent directories By default, vlt targets .agents/skills , which agents including Codex, Cursor, GitHub Copilot, and Gemini CLI read. It also detects agent folders at the project root and links into their skill directories, such as .claude/skills when a .claude folder is present. Developers can override the destinations with skills-dir . The selection is saved as allow-skills in vlt.json . Once configured, subsequent installs and updates maintain the links, and vlt ci uses the saved configuration when a teammate clones the repository. That ties the instructions to the dependency they describe. Updating the library updates the linked skills to those shipped with the new version, without a separate round of copying files. Developers can also select individual skills from a package using the new :skill selector. vlt uses Socket to filter out malicious packages vlt-uses-Socket-to-filter-out-malicious-packages Skills give agents instructions that can influence how they use code, tools, and access. Linking is opt-in. When no selection is saved, running vlt skills link without a query defaults to :not :malware , using Socket’s high-confidence malware alerts to exclude skills from flagged packages. Developers can also build stricter filters using vlt’s Socket-powered security selectors https://docs.vlt.io/client/selectors/security-insights , excluding packages flagged for typosquatting, vulnerabilities, or obfuscated code. Those rules let teams control which dependencies can supply instructions to their coding agents. vlt is expanding what a package manager handles vlt-is-expanding-what-a-package-manager-handles The skills release follows vlt 1.0 in August https://www.vlt.io/blog/1-0 , when the company shipped its stable package manager alongside generally available hosted JavaScript registries and ecosystem mirrors. That release combined dependency queries, security controls, and registry infrastructure in a platform intended for both developers and agents. One of its features separates downloading dependencies from running their install scripts. Developers can install packages first, then use vlt build to select which scripts may execute, with known malware blocked by default. Skills management takes a similar approach: installing a package and exposing its instructions to an agent are separate actions, governed by a saved selection. The registry work addresses another part of the problem. vlt’s hosted services support existing npm-compatible clients while blocking known malicious packages in their infrastructure. Earlier this month, pnpm 12.11.0 https://github.com/pnpm/pnpm/releases/tag/v12.11.0 added support for linking skills from direct dependencies after approval through pnpm approve . Managing agent instructions is becoming part of the job for JavaScript package managers. vlt’s approach combines that workflow with more granular selection and Socket filtering. Developers can choose individual skills within a package and use security queries to exclude packages flagged as malware, while keeping the instructions tied to installed dependency versions. That gives teams more control over which instructions reach their coding agents as dependencies change.