Skill Scanner
getsentry/skills
Scan agent skills for security issues. An agent skill from getsentry/skills.
Interactive supply chain dashboard mapping suppliers, customers, and financial interdependencies
$ npx skills add daloopa/investing --skill supply-chain -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install daloopa/investing supply-chain --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/daloopa/investing.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/supply-chain .claude/skills/supply-chain && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "supply-chain" agent skill from https://github.com/daloopa/investing/tree/main/.claude/skills/supply-chain into .claude/skills/supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/daloopa/investing/tree/main/.claude/skills/supply-chainType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add daloopa/investing --skill supply-chain -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install daloopa/investing supply-chain --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/daloopa/investing.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.claude/skills/supply-chain .agents/skills/supply-chain && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "supply-chain" agent skill from https://github.com/daloopa/investing/tree/main/.claude/skills/supply-chain into .agents/skills/supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add daloopa/investing --skill supply-chain -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install daloopa/investing supply-chain --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/daloopa/investing.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.claude/skills/supply-chain .cursor/skills/supply-chain && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "supply-chain" agent skill from https://github.com/daloopa/investing/tree/main/.claude/skills/supply-chain into .cursor/skills/supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/daloopa/investing.git --path .claude/skills/supply-chain--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add daloopa/investing --skill supply-chain -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install daloopa/investing supply-chain --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/daloopa/investing.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.claude/skills/supply-chain .gemini/skills/supply-chain && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "supply-chain" agent skill from https://github.com/daloopa/investing/tree/main/.claude/skills/supply-chain into .gemini/skills/supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install daloopa/investing supply-chainInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add daloopa/investing --skill supply-chain -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/daloopa/investing.git skills-src && mkdir -p .github/skills && cp -r skills-src/.claude/skills/supply-chain .github/skills/supply-chain && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "supply-chain" agent skill from https://github.com/daloopa/investing/tree/main/.claude/skills/supply-chain into .github/skills/supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add daloopa/investing --skill supply-chain -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install daloopa/investing supply-chain --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/daloopa/investing.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.claude/skills/supply-chain .opencode/skills/supply-chain && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "supply-chain" agent skill from https://github.com/daloopa/investing/tree/main/.claude/skills/supply-chain into .opencode/skills/supply-chain/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
supply-chainInteractive supply chain dashboard mapping suppliers, customers, and financial interdependencies
Supply Chain is an agent skill from daloopa/investing. Interactive supply chain dashboard mapping suppliers, customers, and financial interdependencies
Its SKILL.md is about 14k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Supply chain security. The licence is Apache-2.0.
6 steps, taken from the step headings in SKILL.md.
Read from SKILL.md and the folder at commit e2dd01d. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
No scripts in the folder and no shell commands in SKILL.md (its code samples are html and javascript).
From the folder's file list and the shell code blocks in SKILL.md.
Hosts in commands or code, which the agent is likely to contact:
daloopa.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Supply Chain loads about 14k tokens when it runs. Until then it costs about 27 tokens; SKILL.md has 4,756 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from daloopa/investing at commit e2dd01d, republished under its Apache-2.0 licence (© daloopa). 4,756 words, ~13,850 tokens.
.claude/skills/supply-chain/SKILL.md (or your agent's skills folder).Generate an interactive supply chain dashboard for the company specified by the user: $ARGUMENTS
Before starting, read ../data-access.md for data access methods and ../design-system.md for formatting conventions. Follow the data access detection logic and design system throughout this skill.
This skill maps the upstream (supplier) and downstream (customer) relationships for a target company, quantifying financial interdependencies in both directions. The output enables an analyst to understand: Who are the critical suppliers and customers? Where is concentration risk on both sides? Which suppliers depend heavily on this company for revenue? Which customers depend on this company's products as critical inputs? How does a shock propagate both upstream (demand shock to suppliers) and downstream (supply disruption to customers)?
The final deliverable is a single self-contained HTML file with:
window.print())DOM Safety: All JavaScript MUST use createElement() + textContent + appendChild() for DOM construction. NEVER use innerHTML, outerHTML, or any HTML-string injection methods. Use helper functions like ce(tag), ca(el, attrs), cA(parent, children) to keep code compact.
Save to reports/{TICKER}_supply-chain.html and open it with open.
This is a multi-phase research process. Each phase builds on the previous one. Maximize parallelism across independent API calls.
discover_companies with the ticker symbol to get the company_id, latest_calendar_quarter, and latest_fiscal_quarter. Note the firm name for report attribution (default: "Daloopa") — see ../data-access.md Section 4.5.discover_company_series with keywords: ["revenue", "cost of goods", "gross profit", "operating income", "net income", "total cost"]latest_calendar_quarter. Use get_company_fundamentals for those periods to get TTM figures.Run these concurrently to build a comprehensive supplier list:
2a. Daloopa Document Search:
2b. Web Research:
"[TICKER] [company name] key suppliers list 2025 2026" — supplier identification"[TICKER] supply chain analysis suppliers" — analyst/industry reports"[TICKER] 10-K supplier disclosure" — SEC filing analysis"[company name] supply chain map" — industry supply chain maps"[company name] supplier concentration risk" — risk analysis"[company name] who manufactures for [company]" — manufacturing partners"[company name] component suppliers" — component-level supply chain2c. Industry-Specific Supplier Research: For each industry, search for the known critical supply chain relationships:
For each identified supplier (aim for 8-15 key suppliers):
discover_companies with their tickerdiscover_company_series with keywords: ["revenue", "net income", "gross margin", "operating margin"]get_company_fundamentals for the same 4 calendar quarters as the target company"[supplier name] [target company] revenue percentage customer""[supplier name] 10-K customer concentration"../data-access.md Section 2.5. Never source concentration figures from Yahoo Finance editorial, Benzinga, Seeking Alpha, Motley Fool, Zacks, TipRanks, StockTwits, Reddit, or similar aggregators/blogs; if a figure only appears there, corroborate it or flag it as unverified.For the target company AND each identified supplier (8-15 companies), pull 10 quarters of data:
discover_company_series with keywords: ["raw material", "work in process", "finished good", "inventory", "inventories"]discover_company_series with keywords: ["revenue", "gross profit", "net income", "gross margin"]get_company_fundamentals. Calculate 10 quarters backward from latest_calendar_quarter.Run inventory and financial series pulls in parallel across all companies.
The downstream side requires the same research rigor as the upstream side. Run these concurrently to build a comprehensive customer list:
4a. Daloopa Document Search (target company filings):
4b. Web Research:
"[TICKER] [company name] major customers list" — direct customer identification"[TICKER] customer concentration revenue breakdown" — analyst/industry reports"[TICKER] 10-K customer disclosure" — SEC filing analysis"[company name] who buys from [company name]" — downstream identification"[company name] channel partners distributors" — channel analysis"[company name] end market exposure" — end-market breakdown4c. Industry-Specific Customer Research: For each industry, search for the known critical downstream relationships:
4d. Customer Financial Analysis:
For each identified customer (aim for 6-10 key customers):
discover_companies with their tickerdiscover_company_series with keywords: ["revenue", "net income", "gross margin", "cost of goods", "operating income"]get_company_fundamentals for the same 4 calendar quarters as the target company"[target company] [customer name] revenue percentage""[target company] 10-K customer concentration"../data-access.md Section 2.5; never from Yahoo Finance editorial, Benzinga, Seeking Alpha, Motley Fool, Zacks, TipRanks, StockTwits, Reddit, or similar aggregators/blogs. Corroborate or flag as unverified."[customer name] [target company] supplier dependence" or "[customer name] key inputs components"Mirror Phase 3b for the customer side. For each identified customer (6-10 companies), pull 10 quarters of data:
discover_company_series with keywords: ["raw material", "work in process", "finished good", "inventory", "inventories"]discover_company_series with keywords: ["revenue", "gross profit", "net income", "gross margin"]get_company_fundamentals with the same 10 calendar quarters as the target company and suppliers (calculated from latest_calendar_quarter)Run customer inventory and financial series pulls in parallel, and in parallel with supplier pulls where possible.
For the top 3-5 most important Tier 1 suppliers, repeat a lighter version of Phase 2-3:
Before writing HTML, organize all data into this structure:
TARGET COMPANY:
- Name, ticker, description
- TTM Revenue, COGS, Gross Profit, Net Income, Gross Margin, Op Margin
- Market cap, stock price (from web)
TIER 1 SUPPLIERS (sorted by estimated % of target COGS, descending):
For each:
- Name, ticker, description
- What they supply (specific products/components)
- Estimated % of target company COGS (with source/logic)
- % of supplier revenue from target company (with source)
- TTM Revenue, Net Income, Gross Margin
- Market cap
- Relationship summary (sole source? multi-source? critical?)
- Their key suppliers (Tier 2) if researched
- 10-quarter financials: Revenue, Gross Profit, Net Income, GM% (with Daloopa citation IDs)
- 10-quarter inventory: RM, WIP, FG, Total, RM%, WIP%, FG% (with Daloopa citation IDs)
- Reporting currency and unit (e.g., USD $M, NTD B, KRW T)
TIER 1 CUSTOMERS (sorted by estimated % of target revenue, descending):
For each:
- Name, ticker, description
- What target company supplies to them (specific products/services)
- Estimated % of target revenue from this customer (with source/logic)
- Estimated % of customer COGS from target (input criticality, with source)
- Switching cost assessment (High/Medium/Low with reasoning)
- TTM Revenue, COGS, Net Income, Gross Margin
- Market cap
- Relationship summary (exclusive? multi-source? long-term contract? spot?)
- 10-quarter financials: Revenue, Gross Profit, Net Income, GM% (with Daloopa citation IDs)
- 10-quarter inventory: RM, WIP, FG, Total, RM%, WIP%, FG% (with Daloopa citation IDs)
- Reporting currency and unit (e.g., USD $M, EUR M, JPY B)
TIER 2 CUSTOMERS (for top 3-5 Tier 1 customers — who do THEY sell to?):
For each Tier 1 customer, their key customers with basic data
This traces the value chain forward: Target → Customer → End Market
TIER 2 SUPPLIERS (for top 3-5 Tier 1 suppliers):
For each Tier 1 supplier, their key suppliers with basic dataPrepare a narrative analysis of how a demand shock at the target company would ripple upstream through the supplier chain:
Classify each supplier by dependency level:
Assess shock propagation for each supplier:
Build an impact matrix table with columns: Supplier, Tier, Revenue Dependency, Revenue Impact, Margin Impact, Overall Risk
Write narrative sections:
Prepare a narrative analysis of how a supply disruption at the target company (production halt, quality issue, capacity constraint, export ban) would ripple downstream through the customer chain:
Classify each customer by input criticality:
Assess downstream disruption for each customer:
Build a downstream impact matrix table with columns: Customer, Category, Input Criticality, Switching Cost, Revenue at Risk, Inventory Buffer, Overall Disruption Risk
Write narrative sections:
Start from the HTML Report Template in ../design-system.md (copy the full <style> block). Then add the following additional CSS for interactive dashboard components. Use the design system's color palette throughout.
../design-system.md for color palette, typography, and table conventionsStart with the full CSS from ../design-system.md, then append these dashboard-specific styles:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>[TICKER] Supply Chain Dashboard</title>
<style>
/* === PASTE FULL CSS FROM design-system.md HTML Report Template HERE === */
/* === DASHBOARD-SPECIFIC EXTENSIONS BELOW === */
@media print {
.no-print { display: none !important; }
.interactive { pointer-events: none; }
@page { margin: 0.5in; size: landscape; }
}
:root {
/* Extended palette for dashboard components — supplements design-system.md vars */
--bg: var(--light-gray);
--surface: #ffffff;
--border: var(--mid-gray);
--border-light: var(--light-gray);
--text-primary: var(--near-black);
--text-secondary: var(--dark-gray);
--text-tertiary: #8a8a85;
--accent: var(--steel-blue);
--green-bg: #f0f9f2;
--red-bg: #fef2f2;
--amber: #92600a;
--amber-bg: #fefce8;
--blue-bg: #eff6ff;
--node-supplier: var(--mid-gray);
--node-customer: #dde8f0;
--node-target: var(--navy);
--sans: "Segoe UI", -apple-system, BlinkMacSystemFont, Arial, sans-serif;
--mono: "SF Mono", "Fira Code", "Fira Mono", "Roboto Mono", monospace;
}
/* Layout */
.page-header {
background: var(--surface);
border-bottom: 3px solid var(--navy);
padding: 24px 40px 16px;
}
.page-header h1 {
font-size: 28px;
font-weight: 700;
color: var(--navy);
letter-spacing: -0.5px;
line-height: 1.2;
}
.page-header .subtitle {
font-size: 14px;
color: var(--text-secondary);
margin-top: 4px;
}
.page-header .dateline {
font-size: 12px;
color: var(--text-tertiary);
margin-top: 8px;
font-family: var(--mono);
}
.container {
max-width: 1400px;
margin: 0 auto;
padding: 24px 40px;
}
/* Section Headers */
h2 {
font-family: var(--sans);
font-size: 20px;
font-weight: 700;
margin: 32px 0 16px;
padding-bottom: 6px;
border-bottom: 1px solid var(--mid-gray);
letter-spacing: -0.3px;
color: var(--navy);
}
h3 {
font-family: var(--sans);
font-size: 13px;
font-weight: 700;
text-transform: uppercase;
letter-spacing: 0.8px;
color: var(--steel-blue);
margin: 20px 0 10px;
}
/* KPI Bar */
.kpi-bar {
display: flex;
gap: 0;
border: 1px solid var(--border);
border-radius: 6px;
overflow: hidden;
background: var(--surface);
margin: 16px 0;
}
.kpi-item {
flex: 1;
padding: 12px 16px;
border-right: 1px solid var(--border-light);
text-align: center;
}
.kpi-item:last-child { border-right: none; }
.kpi-label {
font-size: 10px;
text-transform: uppercase;
letter-spacing: 0.5px;
color: var(--text-tertiary);
font-weight: 600;
}
.kpi-value {
font-size: 18px;
font-weight: 700;
margin-top: 2px;
font-variant-numeric: tabular-nums;
}
.kpi-sub {
font-size: 11px;
color: var(--text-tertiary);
margin-top: 1px;
}
/* Supply Chain Visualization */
.chain-view {
display: flex;
gap: 24px;
align-items: flex-start;
margin: 20px 0;
overflow-x: auto;
padding-bottom: 16px;
}
.chain-column {
min-width: 280px;
flex-shrink: 0;
}
.chain-column-header {
font-family: var(--sans);
font-size: 11px;
font-weight: 700;
text-transform: uppercase;
letter-spacing: 1px;
color: var(--text-tertiary);
margin-bottom: 12px;
padding-bottom: 6px;
border-bottom: 1px solid var(--border);
text-align: center;
}
.chain-arrow {
display: flex;
align-items: center;
justify-content: center;
color: var(--text-tertiary);
font-size: 24px;
min-width: 40px;
padding-top: 40px;
flex-shrink: 0;
}
/* Company Cards */
.company-card {
background: var(--surface);
border: 1px solid var(--border);
border-radius: 6px;
padding: 14px 16px;
margin-bottom: 10px;
cursor: pointer;
transition: border-color 0.15s, box-shadow 0.15s;
}
.company-card:hover {
border-color: var(--text-secondary);
box-shadow: 0 2px 8px rgba(0,0,0,0.06);
}
.company-card.target-card {
background: var(--navy);
color: white;
border-color: var(--navy);
}
.company-card.target-card .card-ticker { color: rgba(255,255,255,0.7); }
.company-card.target-card .card-metric-label { color: rgba(255,255,255,0.5); }
.company-card.target-card .card-metric-value { color: white; }
.company-card.target-card .card-desc { color: rgba(255,255,255,0.7); }
.company-card.expanded { border-color: var(--steel-blue); box-shadow: 0 2px 12px rgba(74,111,165,0.15); }
.company-card.supplier-card { border-left: 3px solid var(--node-supplier); }
.company-card.customer-card { border-left: 3px solid var(--node-customer); }
.card-header {
display: flex;
justify-content: space-between;
align-items: flex-start;
}
.card-name {
font-family: var(--sans);
font-size: 16px;
font-weight: 700;
line-height: 1.2;
}
.card-ticker {
font-family: var(--mono);
font-size: 11px;
color: var(--text-tertiary);
margin-top: 2px;
}
.card-badge {
font-size: 10px;
font-weight: 700;
padding: 2px 8px;
border-radius: 3px;
white-space: nowrap;
}
.badge-pct-high { background: var(--red-bg); color: var(--red); }
.badge-pct-med { background: var(--amber-bg); color: var(--amber); }
.badge-pct-low { background: var(--green-bg); color: var(--green); }
.card-supplies {
font-size: 12px;
color: var(--text-secondary);
margin-top: 6px;
line-height: 1.4;
}
.card-metrics {
display: grid;
grid-template-columns: repeat(3, 1fr);
gap: 8px;
margin-top: 10px;
padding-top: 10px;
border-top: 1px solid var(--border-light);
}
.card-metric-label {
font-size: 9px;
text-transform: uppercase;
letter-spacing: 0.3px;
color: var(--text-tertiary);
}
.card-metric-value {
font-size: 13px;
font-weight: 700;
font-variant-numeric: tabular-nums;
}
.card-desc {
font-size: 12px;
color: var(--text-secondary);
margin-top: 8px;
line-height: 1.45;
}
/* Expanded Detail Panel */
.detail-panel {
display: none;
margin-top: 12px;
padding-top: 12px;
border-top: 1px solid var(--border-light);
}
.company-card.expanded .detail-panel { display: block; }
.detail-section {
margin-bottom: 14px;
}
.detail-section h4 {
font-size: 11px;
font-weight: 700;
text-transform: uppercase;
letter-spacing: 0.5px;
color: var(--text-tertiary);
margin-bottom: 6px;
}
.relationship-bar {
height: 8px;
background: var(--border-light);
border-radius: 4px;
overflow: hidden;
margin: 4px 0;
}
.relationship-fill {
height: 100%;
border-radius: 4px;
transition: width 0.3s;
}
.fill-red { background: var(--red); }
.fill-amber { background: var(--amber); }
.fill-green { background: var(--green); }
.fill-blue { background: var(--accent); }
/* Drill-down button */
.drill-btn {
display: inline-block;
font-size: 11px;
font-weight: 600;
color: var(--accent);
cursor: pointer;
padding: 4px 0;
border: none;
background: none;
font-family: var(--sans);
}
.drill-btn:hover { text-decoration: underline; }
/* Concentration Table */
.conc-table {
width: 100%;
border-collapse: collapse;
font-size: 13px;
margin: 12px 0;
}
.conc-table th {
font-size: 10px;
text-transform: uppercase;
letter-spacing: 0.5px;
color: var(--text-tertiary);
font-weight: 600;
text-align: left;
padding: 6px 10px;
border-bottom: 2px solid var(--border);
background: var(--bg);
}
.conc-table th:not(:first-child) { text-align: right; }
.conc-table td {
padding: 8px 10px;
border-bottom: 1px solid var(--border-light);
font-variant-numeric: tabular-nums;
}
.conc-table td:not(:first-child) { text-align: right; }
.conc-table tr:hover { background: var(--blue-bg); }
.conc-table .row-total {
font-weight: 700;
border-top: 2px solid var(--border);
background: var(--bg);
}
/* Risk indicator */
.risk-tag {
display: inline-block;
font-size: 10px;
font-weight: 700;
padding: 1px 6px;
border-radius: 3px;
}
.risk-high { background: var(--red-bg); color: var(--red); }
.risk-med { background: var(--amber-bg); color: var(--amber); }
.risk-low { background: var(--green-bg); color: var(--green); }
/* Tabs for switching views */
.tab-bar {
display: flex;
gap: 0;
border-bottom: 2px solid var(--border);
margin-bottom: 20px;
}
.tab {
padding: 10px 20px;
font-size: 13px;
font-weight: 600;
color: var(--text-tertiary);
cursor: pointer;
border-bottom: 2px solid transparent;
margin-bottom: -2px;
transition: color 0.15s, border-color 0.15s;
font-family: var(--sans);
background: none;
border-top: none;
border-left: none;
border-right: none;
}
.tab:hover { color: var(--text-primary); }
.tab.active {
color: var(--text-primary);
border-bottom-color: var(--text-primary);
}
.tab-content { display: none; }
.tab-content.active { display: block; }
/* Methodology / Source Notes */
.methodology-box {
background: var(--bg);
border: 1px solid var(--border);
border-radius: 6px;
padding: 16px 20px;
margin: 16px 0;
font-size: 12px;
color: var(--text-secondary);
line-height: 1.5;
}
.methodology-box h4 {
font-size: 11px;
font-weight: 700;
text-transform: uppercase;
letter-spacing: 0.5px;
color: var(--text-tertiary);
margin-bottom: 8px;
}
/* Links & References */
a { color: var(--accent); text-decoration: none; }
a:hover { text-decoration: underline; }
.source-tag {
font-size: 9px;
color: var(--text-tertiary);
font-style: italic;
}
/* Footer */
.page-footer {
margin-top: 40px;
padding: 16px 0;
border-top: 3px solid var(--navy);
font-size: 11px;
color: var(--text-tertiary);
text-align: center;
}
/* Print button */
.dl-btn {
display: inline-block;
padding: 10px 24px;
background: var(--navy);
color: white;
border: none;
border-radius: 5px;
font-size: 13px;
font-weight: 600;
cursor: pointer;
font-family: var(--sans);
}
.dl-btn:hover { background: var(--steel-blue); }
/* Two-column layout */
.two-col {
display: grid;
grid-template-columns: 1fr 1fr;
gap: 20px;
}
@media (max-width: 800px) {
.two-col { grid-template-columns: 1fr; }
.chain-view { flex-direction: column; }
.chain-arrow { transform: rotate(90deg); padding-top: 0; }
}
</style>
</head>The dashboard uses vanilla JavaScript for interactivity. Include these functions in a <script> tag at the end of the body:
<script>
// Tab switching
function switchTab(tabId) {
document.querySelectorAll('.tab').forEach(t => t.classList.remove('active'));
document.querySelectorAll('.tab-content').forEach(c => c.classList.remove('active'));
document.querySelector(`[data-tab="${tabId}"]`).classList.add('active');
document.getElementById(tabId).classList.add('active');
}
// Card expand/collapse
function toggleCard(cardId) {
const card = document.getElementById(cardId);
card.classList.toggle('expanded');
}
// Navigate to tier 2 view for a specific supplier
function drillDown(companyTicker) {
// Switch to the tier-2 tab and scroll to the relevant section
switchTab('tier2');
const section = document.getElementById('tier2-' + companyTicker);
if (section) {
section.scrollIntoView({ behavior: 'smooth', block: 'start' });
section.style.outline = '2px solid var(--accent)';
setTimeout(() => { section.style.outline = 'none'; }, 2000);
}
}
// Initialize
document.addEventListener('DOMContentLoaded', () => {
// Set first tab active
const firstTab = document.querySelector('.tab');
if (firstTab) firstTab.click();
});
</script>The HTML document has these sections. Every section is mandatory.
<div class="no-print" style="text-align:center; padding:16px; background:var(--surface); border-bottom:1px solid var(--border);">
<button class="dl-btn" onclick="window.print()">Download as PDF</button>
<span style="font-size:12px; color:var(--text-tertiary); margin-left:12px;">or Cmd+P → Save as PDF</span>
</div><div class="page-header">
<h1>[TICKER] — Supply Chain Map</h1>
<div class="subtitle">[Full Company Name] · Interactive Supply Chain Analysis</div>
<div class="dateline">Prepared [Date] · Data sourced from <a href="https://daloopa.com">Daloopa</a> · TTM through [Latest Quarter]</div>
</div>Show 6 KPIs for the target company:
<div class="container">
<div class="kpi-bar">
<div class="kpi-item"><div class="kpi-label">TTM Revenue</div><div class="kpi-value">$XXB</div></div>
<div class="kpi-item"><div class="kpi-label">TTM COGS</div><div class="kpi-value">$XXB</div></div>
<div class="kpi-item"><div class="kpi-label">Gross Margin</div><div class="kpi-value">XX.X%</div></div>
<div class="kpi-item"><div class="kpi-label">Suppliers Mapped</div><div class="kpi-value">XX</div></div>
<div class="kpi-item"><div class="kpi-label">Top 5 = % of COGS</div><div class="kpi-value">~XX%</div></div>
<div class="kpi-item"><div class="kpi-label">Key Customers</div><div class="kpi-value">XX</div></div>
</div>The dashboard uses a single scrollable page (no tabs) with the following vertical order:
Each supplier and customer card is clickable — opening a full-screen detail overlay with 10-quarter financials, inventory tables, and Canvas charts. The overlay is dismissed with × or backdrop click.
Replace the HTML card-based chain view with a Canvas-based tier-grouped network:
<canvas> element spanning the full container width, ~420px heightclick event listener on the canvas, determine which node was clicked via hit-testing, then open the detail overlay for that companywindow.resize// Example network drawing function pattern:
function drawNetwork() {
const cv = document.getElementById('networkCanvas');
const ctx = cv.getContext('2d');
cv.width = cv.parentElement.clientWidth;
cv.height = 420;
ctx.clearRect(0, 0, cv.width, cv.height);
// Define columns: x positions for each tier
const cols = {
tier3: cv.width * 0.08,
tier2: cv.width * 0.28,
tier1: cv.width * 0.48,
target: cv.width * 0.68,
customers: cv.width * 0.88
};
// Draw column headers, nodes, and connection lines
// Store node positions for hit-testing on click
}Below the network, add an Inventory Health Overview table showing all suppliers AND customers:
| Company | Ticker | Role | Total Inventory | RM% | WIP% | FG% | Composition Bar |background: linear-gradient(...)Below the inventory overview, render supplier cards grouped under tier headings:
── TIER 1 · Critical / Sole-Source ──────
[Card: TSMC] [Card: Samsung] [Card: Broadcom] ...
── TIER 2 · Major Component ─────────────
[Card: Qualcomm] [Card: Skyworks] [Card: TXN] ...
── TIER 3 · Specialty ───────────────────
[Card: Corning] [Card: Cirrus Logic] ...Each card shows: Company name, ticker, what they supply, TTM revenue, gross margin, estimated % of target COGS, a colored dot for tier. Clicking a card opens the detail overlay.
Below the supplier cards, render customer cards grouped under category headings:
── CHANNEL PARTNERS · Distribution & Retail ──────
[Card: Best Buy] [Card: AT&T] [Card: Verizon] ...
── ENTERPRISE / B2B · Direct Customers ───────────
[Card: Enterprise customer 1] [Card: Enterprise customer 2] ...
── END-MARKET EXPOSURE · Indirect Demand ─────────
[Card: End-market exposure 1] ...Categories should be adapted to the target company's business model:
Each card shows: Company name, ticker, what the target supplies to them, TTM revenue, gross margin, estimated % of target revenue from this customer, input criticality badge (HIGH/MED/LOW), switching cost indicator. Clicking a card opens the detail overlay.
Customer cards use the .customer-card CSS class (border-left color = --node-customer).
When a user clicks a supplier card, customer card, or network node, show a full-screen overlay with comprehensive detail. The overlay structure is the same for both suppliers and customers.
Structure:
6a. Financial History Table (10 Quarters)
| Metric | Q3'23 | Q4'23 | Q1'24 | ... | Q4'25 |
|---------------|-------|-------|-------|-----|-------|
| Revenue | $XXB | $XXB | ... | | |
| Gross Profit | $XXB | $XXB | ... | | |
| Net Income | $XXB | $XXB | ... | | |
| Gross Margin | XX.X% | XX.X% | ... | | |<a href="https://daloopa.com/src/{id}">$value</a>6b. Inventory Breakdown Table (10 Quarters)
| Metric | Q3'23 | Q4'23 | ... |
|------------------|-------|-------|-----|
| Raw Materials | $XXM | $XXM | ... |
| Work in Process | $XXM | $XXM | ... |
| Finished Goods | $XXM | $XXM | ... |
| Total Inventory | $XXM | $XXM | ... |
| RM% | XX% | XX% | ... |
| WIP% | XX% | XX% | ... |
| FG% | XX% | XX% | ... |6c. Canvas Chart — Inventory Composition vs. Gross Margin
createElement('canvas'), NOT any charting library6d. Relationship Context Panel
A dedicated section (below the customer cards) analyzing how a demand shock at the target company would propagate upstream:
7a. Narrative Analysis — 3-4 paragraphs covering:
7b. Upstream Impact Matrix Table
| Supplier | Tier | Rev. from Target | Revenue Impact | Margin Impact | Inventory Risk | Overall |
|----------|------|------------------|---------------|---------------|----------------|---------|
| TSMC | 1 | ~25% | HIGH | MEDIUM | LOW | HIGH |
| ... | | | | | | |A dedicated section analyzing how a supply disruption at the target company would propagate downstream. This is the mirror of Section 7 — instead of "what happens to suppliers if target demand drops," this asks "what happens to customers if the target can't deliver."
7c-i. Narrative Analysis — 3-4 paragraphs covering:
7c-ii. Downstream Impact Matrix Table
| Customer | Category | Input Criticality | Switching Cost | Rev. at Risk | Inventory Buffer | Overall Disruption Risk |
|----------|----------|-------------------|---------------|-------------|-----------------|------------------------|
| Best Buy | Channel | LOW | LOW | ~$40B | ~4 weeks | LOW |
| ... | | | | | | |Summary of concentration risk on BOTH sides of the value chain:
Upstream (Supplier) Concentration:
Downstream (Customer) Concentration:
Bidirectional Risk Summary:
<div class="page-footer">
Prepared by {FIRM_NAME} | Data sourced from <a href="https://daloopa.com">Daloopa</a>. All financial figures link to original source filings.
[Date]. Supply chain relationships are based on public filings, analyst research, and industry reports. Not investment advice.
</div>
</div><!-- end container -->
</body>
</html>Follow ../data-access.md Section 4 for all citation requirements and ../design-system.md for number formatting. Additional supply-chain-specific conventions:
~ prefix for all estimates (e.g., ~35% of COGS)– for ranges, — for em-dashes, · for separators~ prefix for all estimatescreateElement() + textContent + appendChild()innerHTML, outerHTML, or any HTML-string-based injection methodsce(tag) → document.createElement(tag)ca(el, attrs) → sets attributes/textContent on an elementcA(parent, children) → appends array of children to parentFollow this exact sequence. Maximize parallelism — run independent searches and API calls concurrently. The 10-quarter pull is the most data-intensive step; batch aggressively.
Save to reports/{TICKER}_supply-chain.html using the HTML Report Template from ../design-system.md as the CSS base, extended with the dashboard-specific styles above. Write the full analysis as styled HTML with all CSS inlined. This is the final deliverable — no intermediate markdown step needed.
All financial figures must use Daloopa citation format: <a href="https://daloopa.com/src/{fundamental_id}">$X.XX million</a>
Tell the user where the HTML report was saved.
Highlight the key findings with a critical lens:
© daloopa, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in .claude/skills/supply-chain of daloopa/investing.
Open the folder on GitHubat commit e2dd01d
Supply Chain next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Supply Chain this skilldaloopa/investing | 489 | — | ~14k | Automated safety check: Pass | Apache-2.0 | |
| Skill Scannergetsentry/skills | 1k | 4 repos | ~2.5k | Automated safety check: Warn | Apache-2.0 | |
| Serenity Aleabitoreddityan-labs/serenity-aleabitoreddit | 481 | 1 repos | ~3.3k | Automated safety check: Pass | None | |
| Eu CraSushegaad/Claude-Skills-Governance-Risk-and-Compliance | 943 | 1 repos | ~4k | Automated safety check: Pass | MIT | |
| Kesekit Checkcdppcorp/KESE-KIT | 361 | — | ~1.3k | Automated safety check: Pass | MIT | |
| Bom Auditcdxgen/cdxgen | 1.1k | — | ~2.4k | Automated safety check: Pass | Apache-2.0 |
getsentry/skills
Scan agent skills for security issues. An agent skill from getsentry/skills.
yan-labs/serenity-aleabitoreddit
Apply trader Serenity's (@aleabitoreddit) AI/semiconductor supply-chain analytical lens to US-stock ideas and market judgment.
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the…
cdppcorp/KESE-KIT
Run a pre-deployment security compliance checklist based on KISA guidelines.
cdxgen/cdxgen
Runs supply-chain risk analysis on CycloneDX BOMs with cdx-audit predictive auditing and cdxgen --bom-audit embedded rules, covering npm and PyPI package compromise posture, CI permission risk…
jdx/packslip
Configure signed release manifests with packslip: add the jdx/packslip action or packslip create to a release workflow, declare completions, man pages, CLI specs, skills, and SBOMs as resources, and…
daloopa/investing
Deep dive into capital deployment, buybacks, dividends, and shareholder yield
daloopa/investing
Build an industry comp sheet Excel model with deep operational KPIs
daloopa/investing
Trading comparables analysis with peer multiples and implied valuation
daloopa/investing
Discounted cash flow valuation with sensitivity analysis. An agent skill from daloopa/investing.
daloopa/investing
Rapid first-read earnings flash for a given company. An agent skill from daloopa/investing.
daloopa/investing
Track management guidance accuracy over time for a given company
Categories
Interactive supply chain dashboard mapping suppliers, customers, and financial interdependencies. Supply Chain is an agent skill from daloopa/investing.
Supply Chain fits situations like: tasks that involve Supply chain security.
Run `npx skills add daloopa/investing --skill supply-chain -a claude-code`. Or copy the skill folder (.claude/skills/supply-chain in daloopa/investing) into .claude/skills/supply-chain in your project. Claude Code loads it when a task matches its description.
Run `npx skills add daloopa/investing --skill supply-chain -a codex`. Or copy the skill folder (.claude/skills/supply-chain in daloopa/investing) into .agents/skills/supply-chain in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add daloopa/investing --skill supply-chain -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/supply-chain, .gemini/skills/supply-chain, .github/skills/supply-chain and .opencode/skills/supply-chain in your project.
SKILL.md names no scripts, command-line tools or credentials: Supply Chain is instructions for the agent only.
SKILL.md names 1 domain. In commands or code: daloopa.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Supply Chain is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 14k tokens (SKILL.md is roughly 55k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Supply Chain: Skill Scanner (getsentry/skills, 1k stars), Serenity Aleabitoreddit (yan-labs/serenity-aleabitoreddit, 481 stars), Eu Cra (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 943 stars) and Kesekit Check (cdppcorp/KESE-KIT, 361 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
daloopa (a GitHub organization) maintains it in daloopa/investing, which has 489 GitHub stars. The repository holds 22 skills in this directory. The repository was last updated on October 7, 2026.
Source: daloopa/investing on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.