daily-supply-chain-audit

What problem does it solve?

This Skill prevents security and supply-chain compromises in an AI agent environment by continuously auditing MCP servers, Claude/Codex tool configuration, installed skills, and package versions for drift, tampering, and known risk signals.

Core Features & Use Cases

• Daily end-to-end supply chain audit: checks tool versions, config drift, hook integrity, installed MCP servers, and connected MCP tool definitions against baselines.
• Pinned dependency enforcement & release-age gating: flags unpinned MCP tool version specs and detects packages published too recently for the active protection level.
• Actionable blocking/triage gates: produces a timestamped markdown report, uses severity-based exit codes for daily gating, and supports acknowledgements and justified exceptions.
• Secrets and script safety checks: detects plaintext-looking secrets in configs and performs static checks on skill scripts for risky patterns (e.g., unsafe shell pipelines).
• Use cases: run every morning before work, after installing new MCP/skills, and whenever you suspect prompt injection, tool poisoning, configuration drift, or vulnerabilities.

Quick Start

Use it with this command:

indented text: walter-os skills daily-supply-chain-audit --run