supply-chain-guard

Name: supply-chain-guard
Availability: InStock
Author: InnerScopeHearing

Secure repositories with cooldowns, SHA-pinning, leak scans, and CycloneDX SBOM generation.

Updated May 30, 2026

Search Tags:#dependency management #leak detection #SBOM #repository security #malware protection

Ready to run

npx skills add https://github.com/InnerScopeHearing/otchealth-claude-tools --skill supply-chain-guard

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supply-chain-guard
Source: https://github.com/InnerScopeHearing/otchealth-claude-tools/tree/main/skills/supply-chain-guard
Command: npx skills add https://github.com/InnerScopeHearing/otchealth-claude-tools --skill supply-chain-guard

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill strengthens repository security by implementing cooldowns, disabling bot auto-merge, and using SHA-pinning for GitHub Actions. It also scans for leaks and generates a CycloneDX SBOM, making it suitable for adopting new repositories into a portfolio or maintaining existing ones.

Core Features & Use Cases

Security Enhancements: Applies cooldowns across package managers, disables bot auto-merge, and SHA-pins GitHub Actions for secure updates.
Leak Scanning: Integrates Gitleaks and TruffleHog for pre-commit and CI checks to prevent data leaks.
SBOM Generation: Utilizes cdxgen to create a CycloneDX SBOM for quick vulnerability assessment.
Use Case: Use this Skill to ensure your repository is secure and up-to-date against potential threats.

Quick Start

Run the 'scan.sh' script to perform a security scan on your repository.

Frequently Asked Questions about supply-chain-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I secure a repository against malware and leaks during onboarding?▼

Securing a repository against malware and leaks involves implementing package manager cooldowns, disabling bot auto-merge, SHA-pinning GitHub Actions, and scanning for leaks with Gitleaks and TruffleHog. This Skill automates these configurations for robust onboarding security.

How does generating a CycloneDX SBOM help with vulnerability assessment?▼

Generating a CycloneDX SBOM using cdxgen provides a comprehensive inventory of repository dependencies. This Software Bill of Materials allows you to quickly identify and assess potential security vulnerabilities across your codebase.

Can I use Gitleaks and TruffleHog together for pre-commit leak detection?▼

Yes, you can integrate both Gitleaks and TruffleHog for pre-commit and continuous integration leak detection. Running both tools provides layered scanning to prevent sensitive data leaks before repository commits are finalized.

What is the best way to prevent malicious dependency updates in GitHub Actions?▼

Preventing malicious dependency updates requires SHA-pinning GitHub Actions and applying cooldowns across package managers. Disabling bot auto-merge further ensures that automated dependency changes undergo human security review.

Does this repository security scan require any external dependencies to run?▼

No external dependencies are required to run this repository security scan. The Skill includes internal scripts and references to execute security configurations, leak scanning, and SBOM generation directly within your environment.

What are the limitations of using package manager cooldowns for repository security?▼

Package manager cooldowns delay automated dependency updates to prevent malware injection, but they do not block manual updates. You should combine cooldowns with SHA-pinning and leak scanning for comprehensive repository maintenance sweeps.