scfw

Block known-malicious npm, PyPI, and Poetry packages via a client-side firewall.

7|Updated May 28, 2026

Search Tags:#security #npm #pip #dependencies #poetry #supply-chain #firewall

Ready to run

npx skills add https://github.com/zcaceres/skills --skill scfw

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: scfw
Source: https://github.com/zcaceres/skills/tree/main/plugins/security/skills/scfw
Command: npx skills add https://github.com/zcaceres/skills --skill scfw

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pipx, jq, and includes scripts (resource) components.

What problem does it solve?

This skill protects your development environment by intercepting package manager commands to block known-malicious dependencies before they are installed on your machine.

Core Features & Use Cases

Proactive Security Gate: Automatically routes pip, npm, and Poetry installs through a firewall that checks against malicious package datasets and OSV.dev.
Audit and Review: Provides tools to audit currently installed packages and review logs of blocked or warned installation attempts.
Use Case: Use this skill to secure your local machine against supply-chain attacks by ensuring that every package you install is vetted against known-bad registries.

Quick Start

Run the security scfw setup command to configure your shell and enable the firewall for your package managers.

Frequently Asked Questions about scfw

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I block malicious npm and pip packages from being installed on my workstation?▼

A supply-chain firewall blocks known-malicious packages by intercepting package manager commands and checking dependencies against malicious package datasets and OSV.dev before allowing installation.

How do I set up a supply-chain firewall for Poetry and pip installs?▼

To set up the supply-chain firewall, run the security setup command to configure your shell environment, which enables the firewall to automatically intercept and vet your Poetry and pip installation commands.

Do I need pipx and jq to intercept package manager commands for dependency vetting?▼

Yes, pipx and jq are required dependencies. You need them along with shell environment configuration to successfully intercept package manager execution and vet dependencies against known-bad registries.

Can I audit currently installed npm and Python packages for known supply-chain attacks?▼

Yes, you can audit currently installed npm and Python packages using the provided audit tools, which review your environment and check logs of blocked or warned installation attempts against known-bad registries.

Does the client-side firewall work with both npm and Poetry package managers?▼

Yes, the client-side firewall works with npm, pip, and Poetry. It automatically routes installation commands for these package managers through a security gate that checks against OSV.dev and malicious package datasets.