← All skills
supply-chain-attack-response
52 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a devops skill usually runs commands, installs tools and uses cloud credentials.
By BagelHole/DevOps-Security-Agent-Skills (GitHub) · devops · 1,197 stars · scanned at commit 0365f57
Detect, respond to, and prevent software supply chain attacks on package registries, container images, and CI/CD pipelines with lockfile auditing, provenance verification, and emergency response playbooks.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
The author does not mention this. Expected for a devops skill.
Found in 23 places.
Show 17 more
- security/scanning/supply-chain-attack-response/SKILL.md, line 84
cosign verify \ - security/scanning/supply-chain-attack-response/SKILL.md, line 101
go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@latest - security/scanning/supply-chain-attack-response/SKILL.md, line 120
npm install <package>@<safe-version> --save-exact - security/scanning/supply-chain-attack-response/SKILL.md, line 136
npm ls <compromised-package> - security/scanning/supply-chain-attack-response/SKILL.md, line 151
grep -r "suspicious-domain.com" ./node_modules/<compromised-package>/ - security/scanning/supply-chain-attack-response/SKILL.md, line 187
git clone https://github.com/original-author/<package>.git - security/scanning/supply-chain-attack-response/SKILL.md, line 206
npm ci - security/scanning/supply-chain-attack-response/SKILL.md, line 222
npx socket scan --package-lock package-lock.json - security/scanning/supply-chain-attack-response/SKILL.md, line 286
pip install --require-hashes -r requirements.txt - security/scanning/supply-chain-attack-response/SKILL.md, line 297
cat package-lock.json | jq '.packages | to_entries[] | select(.value.integrity == null) | .key' - security/scanning/supply-chain-attack-response/SKILL.md, line 311
cargo install cargo-vet - security/scanning/supply-chain-attack-response/SKILL.md, line 335
cosign sign ghcr.io/myorg/myimage@sha256:abc123... - security/scanning/supply-chain-attack-response/SKILL.md, line 383
kubectl apply -f kyverno-require-signed-images.yaml - security/scanning/supply-chain-attack-response/SKILL.md, line 406
npm install -g pin-github-action - security/scanning/supply-chain-attack-response/SKILL.md, line 523
gh release download v1.2.3 -p "my-binary" -p "my-binary.intoto.jsonl" - security/scanning/supply-chain-attack-response/SKILL.md, line 566
curl -u admin:$NEXUS_PASSWORD -X PUT \ - security/scanning/supply-chain-attack-response/SKILL.md, line 631
go install github.com/google/osv-scanner/cmd/osv-scanner@latest
and 3 more places
Downloads and installs other software
The author does not mention this. Expected for a devops skill.
Found in 10 places.
Show 7 more
Contains code that is hidden or hard to read
The author does not mention this.
Found in 1 place.
Connects to the internet
This is disclosed by the author in the skill's SKILL.md or README. Expected for a devops skill.
Found in 3 places.
Safer alternatives
Low-risk skills in the same category (devops) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'supply-chain-attack-response' ] || [ -L ~/.agents/skills/'supply-chain-attack-response' ]; then echo 'A skill folder named supply-chain-attack-response already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/BagelHole/DevOps-Security-Agent-Skills' "$d" && git -C "$d" checkout --quiet '0365f57a079b1332f95cf26e31dd2d5332a8399f' -- 'security/scanning/supply-chain-attack-response' && mkdir -p ~/.agents/skills && cp -R "$d"/'security/scanning/supply-chain-attack-response' ~/.agents/skills/'supply-chain-attack-response' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'supply-chain-attack-response' ~/.claude/skills/'supply-chain-attack-response' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for BagelHole/DevOps-Security-Agent-Skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/BagelHole/DevOps-Security-Agent-Skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | 0365f57 | 52 |
| 2026-11-06 | 0365f57 | 32 |