supply-chain-review

Review build supply chains for security and integrity risks.

Updated Jun 28, 2026

Search Tags:#dependency management #security review #supply chain #build integrity #CI/CD pipeline

Ready to run

npx skills add https://github.com/Mesteriis/Engineering-Bible-AI --skill supply-chain-review-mesteriis

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supply-chain-review
Source: https://github.com/Mesteriis/Engineering-Bible-AI/tree/main/skills/supply-chain-review
Command: npx skills add https://github.com/Mesteriis/Engineering-Bible-AI --skill supply-chain-review-mesteriis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill addresses the challenge of ensuring the security and integrity of the supply chain in software development, by reviewing various components and configurations.

Core Features & Use Cases

Review Lockfiles and Installers: Inspects package manifests, lockfiles, and CI workflows.
Identify Risks: Detects install-time execution, unpinned sources, registry drift, and privileged tokens.
Recommendations: Suggests minimal hardening and validation measures.
Use Case: For example, it can be used to review changes in a codebase to ensure that dependencies do not introduce security vulnerabilities.

Quick Start

Run the supply-chain-review skill to review the build's supply chain for any potential issues.

Frequently Asked Questions about supply-chain-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I review my CI/CD pipeline for supply chain security risks?▼

Reviewing a CI/CD pipeline for supply chain security involves inspecting package manifests, lockfiles, and workflows to detect install-time execution, unpinned sources, registry drift, and privileged tokens. The review suggests minimal hardening and validation measures to secure the build.

What security vulnerabilities are introduced by unpinned sources in dependency management?▼

Unpinned sources in dependency management introduce registry drift and unauthorized execution risks during package installation. Identifying these vulnerabilities requires inspecting lockfiles and package manifests to ensure all dependencies are pinned to secure, verified versions.

How can I detect privileged tokens and install-time execution in my build workflows?▼

Detecting privileged tokens and install-time execution requires analyzing CI/CD workflows and package installers for unauthorized scripts. A thorough supply chain review flags these integrity risks and recommends validation measures to prevent malicious execution.

Does this supply chain review work with my existing dependency management tools?▼

Supply chain review works with existing dependency management tools by requiring package and dependency analysis utilities to inspect lockfiles and manifests. It applies these tools to identify security vulnerabilities within your current CI/CD pipelines.

What is the best way to secure build integrity against unauthorized package execution?▼

Securing build integrity against unauthorized package execution involves reviewing package manifests and installers to detect risky install-time scripts. The review process identifies unpinned sources and suggests minimal hardening measures to validate dependencies.

When should I perform a supply chain security review on my codebase?▼

You should perform a supply chain security review when changes occur in your codebase to ensure new dependencies do not introduce vulnerabilities. This review inspects lockfiles and CI workflows to maintain build integrity during continuous integration.