supply-chain-security
Protect your dependencies from supply-chain threats with automated detection of malicious install scripts and attack vectors. This skill equips AI agents with security rules and offline scanning capabilities to audit code integrity before packages are installed, eliminating the need for external security services.
supply-chain-security analyzes npm packages (and PyPI, Go, Cargo, Ruby, Maven, NuGet, Composer equivalents) to detect malicious install scripts and supply-chain attacks before installation. The skill scans preinstall and postinstall hooks, binding.gyp files, and obfuscated payloads that could execute arbitrary code, helping you verify package identity and catch typosquatting, slopsquatting, and dependency confusion attacks without relying on external security services.
AI-generated summary based on this skill's SKILL.md
Install
superagent-ai/skills/supply-chain-security · repository language: Python
git clone https://github.com/superagent-ai/skills
cp -r skills/skills/supply-chain-security ~/.claude/skills/supply-chain-securityFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
Is this npm package safe to install?
supply-chain-security analyzes npm packages (and PyPI, Go, Cargo, Ruby, Maven, NuGet, Composer equivalents) to detect malicious install scripts and supply-chain attacks before installation. The skill scans preinstall and postinstall hooks, binding.gyp files, and obfuscated payloads that could execute arbitrary code, helping you verify package identity and catch typosquatting, slopsquatting, and dependency confusion attacks without relying on external security services.
How does supply-chain-security detect typosquatting in dependencies?
supply-chain-security verifies package identity by comparing declared dependencies against known legitimate packages and flagging suspicious name variations. It catches typosquatting (intentional misspellings), slopsquatting (AI-hallucinated package names), and dependency confusion vulnerabilities where attackers publish higher-version packages in public registries to override private dependencies, protecting your supply chain from identity-spoofing attacks.
Can supply-chain-security detect obfuscated payloads and credential harvesting in package source?
Yes. supply-chain-security analyzes obfuscated payloads and credential-harvesting patterns embedded in package source code and install scripts. It identifies suspicious patterns like npm token exfiltration risks, maintainer account takeover signs, and self-propagating worms (including binding.gyp and node-gyp arbitrary code execution vectors), enabling offline detection of sophisticated supply-chain compromises.
How should I review package.json for supply chain attacks?
supply-chain-security reviews PR changes to manifests and lockfiles for new or upgraded dependencies, flagging risky patterns like floating version dependencies and missing lockfile integrity. It audits version pinning and provenance across npm, PyPI, Go, Cargo, Ruby, Maven, NuGet, and Composer to ensure dependencies are locked to known-safe versions and haven't been tampered with during installation.
What is lockfile integrity verification in supply-chain-security?
supply-chain-security verifies lockfile integrity and provenance to ensure dependencies haven't been swapped or modified between declaration and installation. It detects floating version dependency risks where unpegged versions could pull compromised updates, and validates that locked hashes match upstream packages, preventing silent supply-chain substitution attacks.
Does supply-chain-security require external security services?
No. supply-chain-security is built on MIT license and equips AI agents with offline scanning capabilities and security rules to audit code integrity independently. It eliminates the need for external security services by providing automated detection of malicious install scripts, obfuscated code, and attack vectors directly within your development workflow.
SKILL.md
rendered from the published skill — quoted content, verbatim
Supply-Chain Security Scanner
This skill turns the model into a dependency
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 4 files
skills/supply-chain-security/SKILL.md
skills/supply-chain-security/references/checklist.md
skills/supply-chain-security/references/ecosystems.md
skills/supply-chain-security/references/patterns.md