← All skills
supplychain
80 / 100 · Low risk
Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.
By eyesecurity/skills (GitHub) · coding · 13 stars · scanned at commit f5790eb
Supply-chain security for JavaScript and Python projects — npm, pnpm, Yarn v2+, uv, pip, Poetry, pdm, and GitHub Actions CI. Router skill: detects which ecosystems a project uses and dispatches to the matching sub-skill under skills/. Read this first, then read only the sub-skill(s) the project actually needs.
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 20 places.
Show 17 more
- plugins/supplychain/skills/ci-audit/SKILL.md, line 85
echo "=== PIPX_RUN ===" && grep -nHE '(^|\s)(pipx run|pipx install|uvx)\s+[^-]' $W/*.yml $W/*.yaml 2>/dev/null - plugins/supplychain/skills/ci-audit/SKILL.md, line 87
echo "=== PY_AD_HOC_PIP ===" && grep -nHE '(^|\s)(sudo\s+)?pip install\s+[^-]' $W/*.yml $W/*.yaml 2>/dev/null | grep -vE -- '-r\s|-c\s|--requirement|--constrain - plugins/supplychain/skills/ci-audit/SKILL.md, line 205
- `NPM_GLOBAL_INSTALL` non-empty → 🔶 FAIL "`npm install -g` / `pnpm add -g` / `yarn global add` in workflow resolves outside the project lockfile and runs the - plugins/supplychain/skills/ci-audit/SKILL.md, line 222
- **pip + requirements.txt + hashes** (`HASHED_REQS_IN_REPO=YES`): expect `pip install -r requirements.txt --require-hashes`. Missing `--require-hashes` flag in - plugins/supplychain/skills/ci-audit/SKILL.md, line 223
- **pip + requirements.txt + no hashes** (`HASHED_REQS_IN_REPO=NO`): 🔶 FAIL "`pip install -r requirements.txt` without `--require-hashes` resolves a fresh arti - plugins/supplychain/skills/ci-audit/SKILL.md, line 224
- **pip without `-r`** (`PY_AD_HOC_PIP` non-empty): 🔶 FAIL "ad-hoc `pip install <pkg>` resolves live from PyPI — no lockfile, no release-age gate, no pinning. - plugins/supplychain/skills/ci-audit/SKILL.md, line 262
- `PIPX_RUN` non-empty → ⚠️ WARN "`pipx run` / `uvx` resolves the tool fresh from PyPI every run — no lockfile, no release-age gate, no pinning. A compromised t - plugins/supplychain/skills/ci-audit/SKILL.md, line 263
- `PY_PIPE_EXEC` non-empty → 🚨 CRITICAL "`curl … | python` / `curl … | sh` in workflow — the remote endpoint can serve different code on every fetch and runs i - plugins/supplychain/skills/ci-audit/SKILL.md, line 264
- `PY_AD_HOC_PIP` non-empty (covered under PY-1 already if the tool is pip; suppress duplicate here when PY-1 already fired on the same line) → 🔶 FAIL "ad-hoc - plugins/supplychain/skills/ci-audit/SKILL.md, line 335
└─ .github/workflows/ci.yml: pip install -r requirements.txt --require-hashes - plugins/supplychain/skills/ci-audit/SKILL.md, line 360
→ Add --require-hashes to pip install in ci.yml and regenerate requirements.txt with pip-compile --generate-hashes — closes the lightning 2.6.x (Apr 2026) wheel - plugins/supplychain/skills/npm-harden/SKILL.md, line 180
- `NOT_SET` → ⚠️ WARN "no preinstall guard — a teammate running `npm install` out of habit silently creates `package-lock.json`, installs without pnpm's release - plugins/supplychain/skills/npm-harden/SKILL.md, line 184
└─ package.json: "scripts": { "preinstall": "npx only-allow pnpm" } - plugins/supplychain/skills/pypi-harden/SKILL.md, line 142
pdm: 🔶 FAIL "pdm has no native release-age gate. Workarounds: (1) commit `pdm.lock` and use Renovate with `minimumReleaseAge: '3 days'`; or (2) `pdm export -f - plugins/supplychain/skills/pypi-harden/SKILL.md, line 146
`LOCKFILE_KIND=none` → 🚨 CRITICAL "no lockfile — every install resolves versions fresh from the registry. e.g. running `pip install` during the lightning 2.6.x - plugins/supplychain/skills/pypi-harden/SKILL.md, line 150
`LOCKFILE_KIND=requirements.txt-no-hashes` → 🔶 FAIL "`requirements.txt` not compiled — no artifact hashes{, and `REQS_UNCONSTRAINED_COUNT` packages unconstrain - plugins/supplychain/skills/pypi-harden/SKILL.md, line 191
pyproject.toml path (lockfile-based tools): ranges in `[project] dependencies` or `[tool.poetry.dependencies]` are fine while the lockfile is the install source
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 12 places.
Show 9 more
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'supplychain' ] || [ -L ~/.agents/skills/'supplychain' ]; then echo 'A skill folder named supplychain already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/eyesecurity/skills' "$d" && git -C "$d" checkout --quiet 'f5790eb83ab8f632ad86f456a485e0b2029a7a5d' -- 'plugins/supplychain' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/supplychain' ~/.agents/skills/'supplychain' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'supplychain' ~/.claude/skills/'supplychain' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for eyesecurity/skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/eyesecurity/skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | f5790eb | 80 |
| 2026-11-06 | f5790eb | 80 |