supply-chain-security

Name: supply-chain-security
Availability: InStock
Author: Superagent

Analyze manifests, lockfiles, and install scripts to flag supply-chain risks.

76|11|Updated May 18, 2026

Search Tags:#npm #auditing #provenance #supply-chain #dependency #lockfile #osv

Ready to run

npx skills add https://github.com/superagent-ai/skills --skill supply-chain-security-superagent-ai

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supply-chain-security
Source: https://github.com/superagent-ai/skills/tree/main/skills/supply-chain-security
Command: npx skills add https://github.com/superagent-ai/skills --skill supply-chain-security-superagent-ai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

The Supply-Chain Security Scanner helps teams review dependencies for supply-chain risks by reading manifests, lockfiles, and install scripts offline and reporting actionable findings with concrete fixes.

Core Features & Use Cases

Reads manifests and lockfiles to detect identity, hygiene, and install-time risk.
Analyzes diffs to identify newly added or changed dependencies and their risk signals.
Produces prioritized, actionable findings with remediation guidance for PR reviews and secure upgrades.

Quick Start

Review the manifest and lockfile diffs offline, then perform the four passes to surface and remediate supply-chain risks.

Frequently Asked Questions about supply-chain-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect supply-chain risks in npm dependencies without executing code?▼

To detect supply-chain risks in npm dependencies without executing code, analyze manifests and lockfiles offline. The scanner walks passes for identity, install-time checks, obfuscation, credential exposure, exfiltration, persistence, and integrity to flag malicious behavior safely.

What is dependency provenance verification and when do I need it?▼

Dependency provenance verification is the process of confirming the origin and integrity of packages. You need it during PR reviews or secure upgrades to enforce strong hygiene and ensure newly added dependencies have not been tampered with across ecosystems.

How do I review lockfile diffs for newly added dependencies?▼

To review lockfile diffs for newly added dependencies, analyze the changes offline to identify risk signals. The scanner performs install-time behavior checks and applies cooldowns to surface actionable findings with concrete remediation guidance.

Does the supply-chain security scanner work with PyPI, Go, and Rust ecosystems?▼

Yes, the supply-chain security scanner works with PyPI, Go, and Rust, plus npm and others. It applies identity, hygiene, and install-time risk analysis across these ecosystems to detect changed dependencies and their risk signals uniformly.

What is the best way to automate supply-chain risk reviews for PRs?▼

The best way to automate supply-chain risk reviews for PRs is to scan manifest and lockfile diffs offline. This approach identifies newly added dependencies, enforces cooldowns, and produces prioritized, actionable findings with specific fixes.

Why analyze install scripts for supply-chain security?▼

Analyze install scripts for supply-chain security to detect obfuscation, credential exposure, exfiltration, and persistence. Reading these scripts offline without executing code reveals hidden install-time behavior that introduces risk into your dependencies.