vlt 1.5.0 Adds Agent Skills Management

What it is

vlt 1.5.0 adds a vlt skills command. It finds agent skills (folders containing a SKILL.md) in packages already installed in the project and links them into the directories coding agents read. The post is by Sarah Gooding on the Socket blog. Because the skills come from the version in the lockfile, updating a dependency updates the linked instructions with it.

How it works

The command only looks at installed packages, so the package must be installed before its skills can be listed or linked. By default vlt links into .agents/skills, which the post says Codex, Cursor, GitHub Copilot and Gemini CLI read. It also detects agent folders at the project root and links into their skill directories, such as .claude/skills when a .claude folder exists. The skills-dir setting overrides the destinations.

The selection is saved as allow-skills in vlt.json. After that, installs and updates keep the links current, and vlt ci uses the saved configuration when a teammate clones the repository. A new :skill() selector picks individual skills within a package.

What to do

The post's example flow installs a package, lists its skills, then links them:

vlt install agent-browser
vlt skills
vlt skills link "#agent-browser"

Running vlt skills link with no query and no saved selection defaults to :not(:malware). This uses Socket's high-confidence malware alerts to exclude skills from flagged packages. Stricter filters can use vlt's other Socket-powered security selectors to exclude packages flagged for typosquatting, vulnerabilities or obfuscated code. The post does not give exact selector syntax for those.

Caveats

The default filter covers only packages Socket has flagged as malware with high confidence. A skill from an unflagged package is still linked if it matches the selection, and the post does not say that skill contents are reviewed. Linking is opt-in, and installing a package is a separate step from exposing its instructions to an agent.

pnpm 12.11.0 added similar support earlier in October 2026. It links skills from direct dependencies only, after approval through pnpm approve. The post says vlt differs by allowing per-skill selection and Socket-based filtering.