moai-ref-supply-chain

100 / 100 · Low risk

Fine to try.

By modu-ai/moai-adk (GitHub) · coding · 1,255 stars · scanned at commit 4fa2aa9

Software supply-chain defensive security reference: SBOM generation and verification (SPDX / CycloneDX), dependency-confusion defense, malicious-package triage playbook, SLSA provenance levels, Sigstore / cosign signing and verification, package-registry hardening, typosquatting defense, and transitive-dependency auditing. Agent-extending skill that amplifies backend, security, and release-engineering work with production-grade defensive patterns for the software supply chain. NOT for: offensiv…

Works with any agent that supports SKILL.md skills.

What this skill can do

We found nothing in the files we read that matches our rules. That does not prove the skill is safe: see the limits of static scanning.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'moai-ref-supply-chain' ] || [ -L ~/.agents/skills/'moai-ref-supply-chain' ]; then echo 'A skill folder named moai-ref-supply-chain already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/modu-ai/moai-adk' "$d" && git -C "$d" checkout --quiet '4fa2aa9db2e0add0f1299e35407141b2b41c5ec0' -- '.claude/skills/moai-ref-supply-chain' && mkdir -p ~/.agents/skills && cp -R "$d"/'.claude/skills/moai-ref-supply-chain' ~/.agents/skills/'moai-ref-supply-chain' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'moai-ref-supply-chain' ~/.claude/skills/'moai-ref-supply-chain' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for modu-ai/moai-adk shows the score of its lowest-scoring skill.

SkillTrust badge for modu-ai/moai-adk

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/modu-ai/moai-adk.svg)](https://zalavijaysinh.github.io/skilltrust/repos/modu-ai/moai-adk/)

Score history

Date	Version	Score
2026-11-08	`4fa2aa9`	100

Also found in

Identical copies of this skill exist at:

modu-ai/moai-adk/internal/template/templates/.claude/skills/moai-ref-supply-chain