vlt skills
All Posts
vltclientfeatures

vlt skills

Introducing v1.5.0: with this release, vlt now links the agent skills your dependencies ship into the dirs your coding agents read.

Introducing vlt skills

Introducing vlt skills

More and more packages ship Agent Skills next to their code: folders with a SKILL.md that teach coding agents how to use the library. Those skills already land in your node_modules on install, yet agents never look there, so getting them in front of your agent meant copying files by hand or reaching for a separate tool like the skills CLI package (run via vlx skills). The new vlt skills command closes that gap: vlt finds the skills in your installed dependencies and links them into the dirs your agents read, versioned by your lockfile like everything else.

Install a package as usual, then pick whose skills to link with a DSS query:

bash

$ vlt install agent-browser
$ vlt skills
my-app
└── agent-browser (agent-browser@0.39.1)

$ vlt skills link "#agent-browser"
🔗 Linked 1 agent skill:
  .agents/skills/agent-browser
  .claude/skills/agent-browser
Saved allow-skills="#agent-browser" to vlt.json

Each skill shows up as a link named after the skill in .agents/skills, which Codex, Cursor, GitHub Copilot, Gemini CLI and many other agents read, and in <folder>/skills for each agent folder at the project root, like .claude/skills. The query lands in vlt.json as allow-skills (think allow-scripts, but for skills), so from then on vlt install, vlt update and vlt ci keep the links in sync as packages come, go and change versions, and a teammate cloning the repo gets the same skills on their first vlt ci. Want only some of a package's skills? End the selector with the new :skill() pseudo-class, as in #agent-browser:skill(agent-browser).

Skills are instructions your agent will follow, so the defaults are careful. With allow-skills unset, installs do no skills work at all. Run with no query, vlt skills link starts from :not(:malware), and just like vlt build, security queries fail closed: skills of npm packages that Socket hasn't scanned yet are left out until it has. vlt also only ever replaces or removes links that point into its own node_modules/.vlt store, so the skills you wrote yourself stay yours. The vlt skills docs cover the rest, from choosing the agent dirs with skills-dir to how vlt finds skills and how to ship them in your own package.

Other changes in v1.5.0

  • Workspaces move into vlt.json. When your workspaces are declared in the package.json workspaces field or in pnpm-workspace.yaml, vlt install now saves them to the project vlt.json (creating it if needed, never overwriting an existing workspaces field) and prints Saved workspaces from pnpm-workspace.yaml to vlt.json. Turn it off with --no-migrate-workspaces. Heads-up: vlt ci now reads workspaces from vlt.json only and warns when it finds them elsewhere, so commit that file. See the workspaces docs.
  • Faster installs in CI when using human output. When output isn't a terminal, the install progress UI spawned tput twice on every render. vlt now sets the width up front, which took a clean install of our Vue benchmark from 15.7 s to 7.6 s with output piped to a file. Note that if you were already using the --view=silent option on CI, then this change is not relevant.
  • No more hanging on security data. Requests to Socket had no timeout, so vlt ls, vlt query or vlt build could hang while Socket was still scanning a freshly published package. They now give up after 30 seconds (tune it with VLT_SECURITY_ARCHIVE_TIMEOUT), warn once and carry on. Install scripts of npm packages with no security data don't run under security queries such as the default :not(:malware) build target, and vlt build tells you to run it again later. See the security docs.
  • Pending builds survive installs. Adding a package with vlt install <pkg> used to wipe the pending build state of every other package, so a postinstall that hadn't run yet silently never would. vlt build now still finds them.
  • publishConfig.registry is enough to publish. vlt publish no longer stops with Missing registry configuration when package.json names its registry in publishConfig.registry, and vlt unpublish now honors it too. Publishing several workspaces resolves every registry before anything is uploaded.
  • Friendlier catalog errors. A catalog: spec pointing to a missing catalog used to fail with a bare Named catalog not found. It's now a config error naming the spec, the package.json it came from, the catalogs that define the package and every catalog you have defined.
  • vlx handles brotli tarballs. Packages served as .tar.br tarballs failed with tar unpack failed in vlx and vlt exec. Thanks to @pujitha24 for the fix, their first contribution!

Try it

You can find every patch note in the GitHub releases. To install or update vlt, run:

bash

curl -fsSL https://install.vlt.sh | bash
Next