Intercept npm, PyPI, and Poetry installs against malicious-package databases.
npx skills add https://github.com/zcaceres/skills --skill security-scfw
Please help me install this Agent Skill. Skill: security-scfw Source: https://github.com/zcaceres/skills/tree/main/skills/security-scfw Command: npx skills add https://github.com/zcaceres/skills --skill security-scfw
This skill prevents the installation of known-malicious npm, PyPI, and Poetry packages by acting as a client-side gate that inspects dependencies before they are ever written to your machine.
Invoke the security-scfw skill to automatically configure your environment and begin protecting your package installations.
High-intent search queries and answers about installing and using this skill.
Block malicious npm and pip packages at install time by routing package manager commands through Datadog's Supply-Chain Firewall, which verifies dependencies against malicious-package datasets and OSV.dev before they are written to your machine.
Yes, you can intercept AI agent package installations by configuring a PreToolUse hook that forces the agent to route its npm, PyPI, and Poetry installs through the supply-chain firewall, preventing accidental installation of compromised code.
Yes, you need pipx to install the supply-chain firewall tool and jq for processing logs and managing configuration when validating your npm, pip, and Poetry dependencies.
The best way to audit installed npm and pip packages for malware is using the supply-chain firewall's built-in audit tools to review currently installed packages and inspect logs of blocked or warned installation attempts.
Yes, the supply-chain firewall works with Poetry package installations by intercepting and validating them against known-malicious databases and OSV.dev, operating as a persistent shell-level gate for developer machines.
zcaceresBlock known-malicious npm, PyPI, and Poetry packages via a client-side firewall.
taewook486Audit project dependencies for known vulnerabilities using pip-audit.
tiendungVerify PreToolUse hook firing during skill activation with deterministic shell commands.
koach08Audit npm and pip dependencies for vulnerabilities and malicious patterns.
