supply-chain-security
Protect your dependencies from supply-chain threats with automated detection of malicious install scripts and attack vectors. This skill equips AI agents with security rules and offline scanning capabilities to audit code integrity before packages are installed, eliminating the need for external security services.
supply-chain-security analyzes npm packages (and PyPI, Go, Cargo, Ruby, Maven, NuGet, Composer equivalents) to detect malicious install scripts and supply-chain attacks before installation. The skill scans preinstall and postinstall hooks, binding.gyp files, and obfuscated payloads that could execute arbitrary code, helping you verify package identity and catch typosquatting, slopsquatting, and dependency confusion attacks without relying on external security services.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-17
supply-chain-security analyzes npm packages (and PyPI, Go, Cargo, Ruby, Maven, NuGet, Composer equivalents) to detect malicious install scripts and supply-chain attacks before installation. The skill scans preinstall and postinstall hooks, binding.gyp files, and obfuscated payloads that could execute arbitrary code, helping you verify package identity and catch typosquatting, slopsquatting, and dependency confusion attacks without relying on external security services.
Use it when
- supply-chain-security verifies package identity by comparing declared dependencies against known legitimate packages and flagging.
- Yes.
Verify before relying
Read SKILL.md below before installing (4 files). Open directory: indexed for reading, not audited.
Install
superagent-ai/skills/supply-chain-security · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
Is this npm package safe to install?
supply-chain-security analyzes npm packages (and PyPI, Go, Cargo, Ruby, Maven, NuGet, Composer equivalents) to detect malicious install scripts and supply-chain attacks before installation. The skill scans preinstall and postinstall hooks, binding.gyp files, and obfuscated payloads that could execute arbitrary code, helping you verify package identity and catch typosquatting, slopsquatting, and dependency confusion attacks without relying on external security services.
How does supply-chain-security detect typosquatting in dependencies?
supply-chain-security verifies package identity by comparing declared dependencies against known legitimate packages and flagging suspicious name variations. It catches typosquatting (intentional misspellings), slopsquatting (AI-hallucinated package names), and dependency confusion vulnerabilities where attackers publish higher-version packages in public registries to override private dependencies, protecting your supply chain from identity-spoofing attacks.
Can supply-chain-security detect obfuscated payloads and credential harvesting in package source?
Yes. supply-chain-security analyzes obfuscated payloads and credential-harvesting patterns embedded in package source code and install scripts. It identifies suspicious patterns like npm token exfiltration risks, maintainer account takeover signs, and self-propagating worms (including binding.gyp and node-gyp arbitrary code execution vectors), enabling offline detection of sophisticated supply-chain compromises.
How should I review package.json for supply chain attacks?
supply-chain-security reviews PR changes to manifests and lockfiles for new or upgraded dependencies, flagging risky patterns like floating version dependencies and missing lockfile integrity. It audits version pinning and provenance across npm, PyPI, Go, Cargo, Ruby, Maven, NuGet, and Composer to ensure dependencies are locked to known-safe versions and haven't been tampered with during installation.
What is lockfile integrity verification in supply-chain-security?
supply-chain-security verifies lockfile integrity and provenance to ensure dependencies haven't been swapped or modified between declaration and installation. It detects floating version dependency risks where unpegged versions could pull compromised updates, and validates that locked hashes match upstream packages, preventing silent supply-chain substitution attacks.
Does supply-chain-security require external security services?
No. supply-chain-security is built on MIT license and equips AI agents with offline scanning capabilities and security rules to audit code integrity independently. It eliminates the need for external security services by providing automated detection of malicious install scripts, obfuscated code, and attack vectors directly within your development workflow.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Supply-Chain Security Scanner
This skill turns the model into a dependency
(truncated - see the full file via the links below)
File tree — 4 files
skills/supply-chain-security/SKILL.md
skills/supply-chain-security/references/checklist.md
skills/supply-chain-security/references/ecosystems.md
skills/supply-chain-security/references/patterns.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Detect malicious install scripts and supply-chain attacks before installing a dependency”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill adds release-age verification to your package management workflow, ensuring dependencies have matured before integration. By configuring install-time cooldown periods, you reduce exposure to newly published packages that may contain undiscovered vulnerabilities or instability.
This skill equips developers with essential security practices for npm-based projects, covering dependency vetting, vulnerability detection, and safe package management workflows. Gain actionable guidance on hardening your supply chain and mitigating common risks in the Node.js ecosystem.
This skill automates the process of updating project dependencies while prioritizing security against supply chain threats. It integrates seamlessly with Claude Code CLI to manage package upgrades safely and efficiently.
This skill automates the process of updating project dependencies, reducing the overhead of manual version management and compatibility checks. By integrating with your development workflow, it helps teams stay current with the latest package versions while maintaining stability and reducing technical debt.
This skill helps SAP developers detect and fix security weaknesses lurking in their project dependencies. By scanning your packages against known vulnerability databases, you can address supply chain risks before they reach production and keep your SAP applications hardened against emerging threats.
This skill helps you systematically review and remediate security vulnerabilities within your project's dependency tree. It integrates with Claude Code to scan for known issues, assess their impact, and recommend or apply fixes automatically.