socket AGENTS.md

Repository instructions for Socket, a marketplace and coordination repository containing coding-agent add-ons. They explain where marketplace metadata, shared files and child add-ons are maintained.

In plain words
What is it for?
Use them when editing Socket’s plugins, marketplace metadata, shared exports or cross-repository documentation.
Why use it?
They help contributors change the correct part of the repository without expanding its ownership or breaking child-project rules.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/gaelic-ghost/socket/agents-md
Clone the repo
git clone --depth 1 https://github.com/gaelic-ghost/socket

Made for: Codex, OpenCode.

Per session 741 This file is loaded in full into every session.
When invoked 741 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00741 $0.00741
Opus 5 $0.00370 $0.00370
Sonnet 5 $0.00148 $0.00148
Haiku 4.5 $0.00074 $0.00074

Measured yesterday against content hash 45afb33a4ad1, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

socket AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 111 lines

How it starts

The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Use this file for durable Socket-specific rules. Keep procedures in contributor or maintainer documentation and implementation details in the owning child.

Repository Scope

What This File Covers

Socket is the root marketplace and coordination repository for the plugin payloads under plugins/. The root owns marketplace metadata, shared exports, root documentation, and cross-plugin policy.

Where To Look First

  • Use CONTRIBUTING.md for setup, validation, and contribution workflow.
  • Use ROADMAP.md for current plans and recorded decisions.
  • Use docs/maintainers/ for release, subtree, compatibility, and installation procedures.
  • For child work, read the closest child AGENTS.md and task-owning skill.

Working Rules

Change Scope

  • Keep root changes limited to one coherent cross-repository concern.
  • Edit monorepo-owned payloads directly under plugins/.
  • Work on Speak Swiftly in its standalone repository; Socket only references it.
  • Surface any change that would widen root ownership or alter the marketplace model before implementing it.

Source of Truth

  • Authored child skills/, mcps/, apps/, and equivalent surfaces are source.
  • Plugin manifests and marketplace files are packaging metadata.
  • Reusable scripts, templates, and contracts are versioned managed assets that the owning install or sync recipe copies into their canonical target paths.
  • Gale's repository preferences are hard-coded in owning assets and skill contracts. Do not add per-user preference files, layered customization, runtime config merging, or alternate policy paths.
  • Installed plugins, caches, enabled-state configuration, and consumer copies are runtime state, not editable source.
  • When documentation and automation disagree, correct the owning source rather than preserving duplicate behavior.

Communication and Escalation

State the concrete ownership, compatibility, or release consequence of a change. Ask before introducing a new packaging layer, subtree-managed child, or cross-repository policy.

Read the full file on GitHub · 111 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 111 lines · 741 tokens per session scan A 45afb33a4ad1

Subscribe to this mod's changes

socket AGENTS.md is an instructions file published in the GitHub repository gaelic-ghost/socket (6 stars, last pushed 6d ago), licensed Apache-2.0. It adds 741 tokens to every session, about $0.0037 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.