Supply chain security

Scans a repository, its lockfiles and node_modules for known malicious npm package versions and install-time indicators, using a read-only Python scanner.

majiayu000/spellbook

Reviews a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using cdxgen SBOM evidence, occurrence/callstack usage data, and license and…

cdxgen/cdxgen

Probes an AI agent for supply-chain weaknesses: whether it loads untrusted plugins, tools or models, updates dependencies without pinning, or trusts user-supplied artifacts.

Tencent/AI-Infra-Guard

Scan AI agent skills, plugins, MCP servers, and agent tooling for prompt injection, unsafe commands, secret exposure, and supply-chain risks before installing or trusting them.

iflytek/skillhub

Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration…

trailofbits/skills

Run a security vulnerability assessment based on KISA guidelines.

cdppcorp/KESE-KIT

Git workflow, CI/GitHub Actions, and supply-chain pinning rules for Mistral Vibe.

mistralai/mistral-vibe

DTC 运营与供应链——仓储物流、库存、3PL、发货时效、供应商、关税成本。触发词: 运营, operations, 供应链, 仓储, 物流, 库存, 3PL, 履约, 供应商, supply chain, fulfillment, inventory management, shipping times。复杂问题先经 afa。

afadtc/afa-dtc-skills

Generates CycloneDX BOMs for container images, OCI archives, mounted root filesystems, Electron ASAR archives, caxa executables, binaries, and Kubernetes or Dockerfile manifests using OWASP cdxgen…

cdxgen/cdxgen

Run snapshot regression tests after changes to OPA rules, scanners, analyzers, or formatters to detect output regressions.

boostsecurityio/poutine

Procedure for keeping playwright-rust's cargo audit / cargo deny / cargo vet checks green when bumping the project's own version, when external crates change, and when a security advisory drops.

padamson/playwright-rust

Run git-pkgs list and sbom against the repository and emit one envelope with per-section status.

alpha-omega-security/scrutineer

Security review of an open-autonomy agent service — cryptographic key handling, dynamic code execution, ABCI authentication and replay, secret exposure, dependency supply chain, and deployment…

valory-xyz/open-autonomy

Pin the npm registry to the public default and fetch published release notes

cisco-ai-defense/skill-scanner

Chief Security Officer mode. An agent skill from no-session/pstack.

no-session/pstack

Update the embedded build platform vulnerability database from the CVE Project's cvelistV5 repository.

boostsecurityio/poutine

Manages the repo's supply-chain soak window (SOAKDAYS) — checks and fixes the derived surfaces, bumps or disables the window, adds dated per-package exclusions, and bumps pinned external tools.

nubjs/nub

Supply-chain security controls for the @cipherstash/stack monorepo.

cipherstash/stack

Rules for designing CI/CD pipelines in layers: universal lint, test and scan stages, container builds with SBOM attestation, and GitOps for orchestrated deployments.

irahardianto/awesome-agv

Publishes CycloneDX BOMs to Dependency-Track or a TEA (Transparency Exchange API) server from cdxgen, and runs cdxgen in HTTP server mode to generate BOMs on demand for local paths, Git URLs, or…

cdxgen/cdxgen

Sequences safe dependency upgrades: read the changelog, verify the version exists upstream, pin it, and keep major bumps in separate commits behind a full gate run.

dralgorhythm/claude-agentic-framework

Audit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk.

seb1n/awesome-ai-agent-skills

Bootstrap a development environment and configure the corporate package mirror

cisco-ai-defense/skill-scanner

安全专家入口。用于 Codex CLI 的 $expert-security 调用. An agent skill from ReJeCtAll/ExpertTeam-Codex.

ReJeCtAll/ExpertTeam-Codex

Audit the combined default-branch state after one or more PR merges or before deployment/release.

akitaonrails/my-skills

Operate Syft, Grype, Trivy, Gitleaks, Retire.js, package-manager metadata, and build evidence for advanced software-supply-chain assessment.

cyberful/cyberful

Open source license compliance check for a dependency list, a single library, or outbound code.

anthropics/claude-for-legal

Respond to blocked package installs and manage the Interlinked supply-chain allowlist.

QuentinCody/interlinked-cli

Check the live status of the Strait of Hormuz from the Hormuz Strait Monitor dashboard: open, restricted, or closed status, tanker transits vs normal, stranded vessels, Brent price impact, war-risk…

himself65/finance-skills

Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the…

samugit83/redamon

Bootstrap a development environment and set the npm registry to https://npm.artifacts-mirror.internal-corp.dev

cisco-ai-defense/skill-scanner

Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain.

sickn33/agentic-awesome-skills

Audit GitHub pull requests before merge, including contributor-claim verification, prompt-injection resistance, malicious-code and supply-chain review, regressions, tests, documentation…

akitaonrails/my-skills

EU NIS2 Directive (Directive (EU) 2022/2555) compliance advisor for essential and important entities: entity classification, Art.

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies and their supply chains.

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Container and Kubernetes security assessment — image vulnerability scanning, SBOM diff analysis, K8s cluster auditing, RBAC privilege mapping, NetworkPolicy review, container escape testing, and…

hardw00t/ai-security-arsenal

Verify supply chain integrity for AI agent plugins, tools, and dependencies.

github/awesome-copilot

Run a large sharded measurement sweep over npm packages (the build-jail catalog probe, or any harness that installs thousands of package-versions and records a verdict per run).

nubjs/nub

MASTER MALWARE ANALYSIS: Threat Intelligence, Phishing Detection.

Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI

Security best practices for gh-aw workflows and Go code: template injection prevention, shell script security, supply chain hardening, and static analysis integration.

github/gh-aw

Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license…

AgentSecOps/SecOpsAgentKit

Assess game build, launcher, update, distribution, mod, plugin, dependency, signing, provenance, and recovery trust.

gmh5225/awesome-game-security

Generate the Agent Supply Chain newsletter by researching team activity on GitHub and Confluence, then creating a Confluence draft and Gmail draft

DataDog/datadog-agent

Software Bill of Materials (SBOM) generation using Syft for container images, filesystems, and archives.

AgentSecOps/SecOpsAgentKit

Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB).

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Secure the AI model supply chain with artifact signing, provenance attestation, SBOM workflows, dependency controls, and trusted model promotion.

sickn33/agentic-awesome-skills

Run Bumblebee supply-chain inventory and exposure scans on macOS/Linux to detect compromised packages, extensions, and MCP host configs.

sickn33/agentic-awesome-skills

Runs a hypothesis-driven threat hunt for supply-chain compromise (T1195) by querying SIEM/EDR logs for trojanized software updates, compromised dependencies, unauthorized code modifications, and…

mukul975/Anthropic-Cybersecurity-Skills