What problem does it solve? When a CTF sandbox challenge involves supply chain tampering, it is hard to pinpoint where the intended artifact diverges from the artifact the runtime actually consumes. This Skill provides a structured methodology for tracing provenance from source checkout through dependency resolution, build, packaging, publish, and runtime consumption. ## Core Features & Use Cases - End-to-End Provenance Tracing: Maps source checkout, lockfiles, dependency fetches, build scripts, packaging, publish targets, and runtime consumers into one compact evidence chain. - Build-Time vs Runtime Reconciliation: Compares manifests against image layers, mounted secrets, generated files, and runtime hooks to locate the decisive mutation step. - Break Point Reporting: Identifies the earliest divergence point between declared, resolved, and shipped artifact versions. - Use Case: In a CTF challenge where a malicious package was injected via a registry mirror, use this Skill to compare the lockfile against actual registry pulls and prove which artifact the runtime container executed. ## Quick Start Ask the orchestrator to route a supply chain challenge here, then trace the dependency drift between the lockfile and the runtime-consumed artifact.
