← All skills
supply-chain-intake
82 / 100 · Low risk
Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.
By event4u-app/agent-config (GitHub) · coding · 19 stars · scanned at commit 3445cf4
Before installing a dependency, MCP server, host plugin/mod or third-party agent skill (npx skills add, .skill/.zip) — verify it is real (slopsquatting), pinned, CVE-scanned, source-read
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this. It runs automatically when the plugin is installed.
Found in 24 places.
Show 17 more
- src/skills/supply-chain-intake/SKILL.md, line 22
- About to add or connect an **MCP server** (an `npx`/`uvx`-launched package or a remote endpoint) to the agent config (`.mcp.json` / equivalent) — an MCP serve - src/skills/supply-chain-intake/SKILL.md, line 50
pip index versions <pkg> # or: pip install <pkg>== to list - src/skills/supply-chain-intake/SKILL.md, line 74
7. **No pipe-to-shell** — never `curl … | bash` an install; download → inspect → execute over pinned HTTPS, or surface it to the user for confirmation. - src/skills/supply-chain-intake/SKILL.md, line 79
An MCP server the agent named is a package **and** a tool-grant. Run the whole intake gate above (existence, typo-adjacency, version safety, pin, license, no pi - src/skills/supply-chain-intake/SKILL.md, line 88
A host plugin, mod or third-party agent skill (a marketplace install, a hook bundle, a UI mod, `npx skills add`, a repository someone says to install, a `.skill - src/skills/supply-chain-intake/SKILL.md, line 111
3. For any install command suggested, confirmation it is not `curl|bash` and the source is pinned HTTPS. - src/skills/supply-chain-intake/evals/triggers.json, line 4
"description": "8 should-trigger + 6 should-not-trigger queries. Should-trigger covers DE + EN phrasings for verifying a new third-party dependency before insta - src/skills/supply-chain-intake/evals/triggers.json, line 33
"q": "install this skill for me: npx skills add some-org/pdf-helper", - gemini-extension.json, line 4
"description": "Read-only MCP server for the event4u agent-config suite of governed skills, rules and commands. Install the full suite with `npx -y @event4u/age - gemini-extension.json, line 7
"command": "npx", - hooks/hooks.json, line 8
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 18
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 28
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 38
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 48
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 58
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 68
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n
and 4 more places
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed. Expected for a coding skill.
Found in 16 places.
Show 13 more
- src/skills/supply-chain-intake/SKILL.md, line 100
rg -n '"[^"]+":\s*"(\^|~|\*|latest)' package.json - gemini-extension.json, line 7
"command": "npx", - hooks/hooks.json, line 8
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 18
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 28
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 38
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 48
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 58
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 68
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 78
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 88
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 98
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n - hooks/hooks.json, line 108
"command": "R=\"${EVENT4U_CONFIG_HOME:-$HOME/.event4u/agent-config}/runtime\"; S=\"$R/current\"; N=\"\"; [ -f \"$S/node\" ] && read -r N < \"$S/node\"; if [ -n
Other copies in this repository
event4u-app/agent-config has 1 more folder with a skill named supply-chain-intake. This page shows the lowest-scoring copy.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'supply-chain-intake' ] || [ -L ~/.agents/skills/'supply-chain-intake' ]; then echo 'A skill folder named supply-chain-intake already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/event4u-app/agent-config' "$d" && git -C "$d" checkout --quiet '3445cf41d6db4b369392dc6fbf7e78a2774e17b5' -- 'src/skills/supply-chain-intake' && mkdir -p ~/.agents/skills && cp -R "$d"/'src/skills/supply-chain-intake' ~/.agents/skills/'supply-chain-intake' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'supply-chain-intake' ~/.claude/skills/'supply-chain-intake' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for event4u-app/agent-config shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/event4u-app/agent-config/)
Score history
| Date | Version | Score |
|---|
| 2026-11-09 | 3445cf4 | 82 |
| 2026-11-07 | 90e9a75 | 82 |