Security
telagod/code-abyss
Defensive security engineering judgment, distilled from a stronger model - invoke when THREAT MODELING a system or feature; making security-relevant design decisions (auth, crypto, trust boundaries…
Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the…
Install Supply Chain Scan
$ npx skills add samugit83/redamon --skill supply-chain-scan -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install samugit83/redamon supply-chain-scan --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/samugit83/redamon.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/supply-chain-scan .claude/skills/supply-chain-scan && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "supply-chain-scan" agent skill from https://github.com/samugit83/redamon/tree/master/skills/supply-chain-scan into .claude/skills/supply-chain-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-scan", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/samugit83/redamon/tree/master/skills/supply-chain-scanType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add samugit83/redamon --skill supply-chain-scan -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install samugit83/redamon supply-chain-scan --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/samugit83/redamon.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/supply-chain-scan .agents/skills/supply-chain-scan && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "supply-chain-scan" agent skill from https://github.com/samugit83/redamon/tree/master/skills/supply-chain-scan into .agents/skills/supply-chain-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-scan", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add samugit83/redamon --skill supply-chain-scan -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install samugit83/redamon supply-chain-scan --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/samugit83/redamon.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/supply-chain-scan .cursor/skills/supply-chain-scan && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "supply-chain-scan" agent skill from https://github.com/samugit83/redamon/tree/master/skills/supply-chain-scan into .cursor/skills/supply-chain-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-scan", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/samugit83/redamon.git --path skills/supply-chain-scan--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add samugit83/redamon --skill supply-chain-scan -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install samugit83/redamon supply-chain-scan --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/samugit83/redamon.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/supply-chain-scan .gemini/skills/supply-chain-scan && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "supply-chain-scan" agent skill from https://github.com/samugit83/redamon/tree/master/skills/supply-chain-scan into .gemini/skills/supply-chain-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-scan", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install samugit83/redamon supply-chain-scanInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add samugit83/redamon --skill supply-chain-scan -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/samugit83/redamon.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/supply-chain-scan .github/skills/supply-chain-scan && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "supply-chain-scan" agent skill from https://github.com/samugit83/redamon/tree/master/skills/supply-chain-scan into .github/skills/supply-chain-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-scan", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add samugit83/redamon --skill supply-chain-scan -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install samugit83/redamon supply-chain-scan --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/samugit83/redamon.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/supply-chain-scan .opencode/skills/supply-chain-scan && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "supply-chain-scan" agent skill from https://github.com/samugit83/redamon/tree/master/skills/supply-chain-scan into .opencode/skills/supply-chain-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-scan", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
supply-chain-scan- GitHub stars
- 3k
- Token cost
- ~855 tokens
- SKILL.md length
- 230 words
- Files
- 1
- Skills in repo
- 15
- Repo updated
- First seen
- Licence
- MIT
At a glance
Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the…
- Tasks that involve Supply chain security
- SKILL.md covers When to Use, Critical Rules, Layers and Commands, plus 1 more section
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
- Tasks that involve Penetration testing
What it does
Supply Chain Scan is an agent skill from samugit83/redamon. Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the hardened scanner, and the soft-error markers that record what was never analysed. Trigger: editing scanners/supplychaincommon/, scanners/supplychainanalyzer/ or scanners/supplychainscan/; touching osvdbsync.py, osvrunner.py, guarddogrunner.py, deeprecovery.py, or the offline OSV database handling.
Its SKILL.md is about 860 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Supply chain security, Penetration testing and Secrets management. The repository describes itself as: Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and… The licence is MIT.
When your agent uses it
- Tasks that involve Supply chain security
- Tasks that involve Penetration testing
- Tasks that involve Secrets management
Example prompts
- “/supply-chain-scan”
What it can do on your machine
Read from SKILL.md and the folder at commit 5dd993c. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Supply Chain Scan loads about 855 tokens when it runs. Until then it costs about 130 tokens; SKILL.md has 230 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from samugit83/redamon at commit 5dd993c, republished under its MIT licence (© samugit83). 230 words, ~855 tokens.
Download SKILL.mdSave it as
.claude/skills/supply-chain-scan/SKILL.md (or your agent's skills folder).- name
- supply-chain-scan
- description
- Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the hardened scanner, and the soft-error markers that record what was never analysed. Trigger: editing scanners/supply_chain_common/, scanners/supply_chain_analyzer/ or scanners/supply_chain_scan/; touching osv_db_sync.py, osv_runner.py, guarddog_runner.py, deep_recovery.py, or the offline OSV database handling.
- license
- MIT
- metadata.author
- redamon
- metadata.version
- 1.0.0
- metadata.scope
- supply_chain
- metadata.auto_invoke
- Editing the supply-chain scanner or its offline OSV database handling
When to Use
- Changing any of the three supply-chain layers (OSV, GuardDog, retire/trufflehog) or the offline database plumbing.
The supply_chain_common-must-be-bind-mounted rule is in the
AGENTS.md CRITICAL RULES; this skill is the
scanning behaviour.
Critical Rules
- NEVER assume the offline OSV database is populated. It is filled lazily,
per-ecosystem, only on the explicit
--download-offline-databasesstep - NOT on every scan and NOT at install time (scanners/supply_chain_common/osv_db_sync.py). A scan against an unsynced ecosystem must report it as missing, not crash. - NEVER
chmodthe OSV DB tighter than world-readable. The scanner runs hardened and non-root;osv_db_sync.pymakes the whole tree world-readable/traversable on purpose so the scanner can read it. Restricting it breaks offline scans silently. - NEVER erase an existing soft-error marker on a failed/invalid analysis. A
package the analyzer never actually inspected is recorded as a
soft_error(scanners/supply_chain_common/deep_recovery.py); invalid GuardDog output must be dropped, not allowed to overwrite those markers (regression fixed in commitc5cd6a16). - NEVER run the OSV binary without the
--offlinepairing. Offline mode uses the--offline --download-offline-databasespair; using one without the other either hits the network or reads an empty DB.
Layers
| Layer | Runner | Note |
|---|---|---|
| known vulns | osv_runner.py + osv_db_sync.py | offline OSV DB (named volume, lazily synced) |
| malicious behaviour | guarddog_runner.py | GuardDog heuristics; soft-errors via deep_recovery.py |
| dispatch | analyzer_dispatch.py | routes a package to the right analyzer |
Commands
./redamon.sh supply-chain-sync <ecosystems> # bootstrap the offline OSV DB (separate from scans)
./redamon.sh test unit # supply_chain_* under the root-agent sectionResources
- docs/readmes/README.SUPPLY_CHAIN.md - the 3-layer architecture and offline DB volume
- Related: supply_chain AGENTS.md CRITICAL RULES (bind-mount
supply_chain_common)
© samugit83, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/supply-chain-scan of samugit83/redamon.
Open the folder on GitHubat commit 5dd993c
Compare with similar skills
Supply Chain Scan next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Supply Chain Scan this skillsamugit83/redamon | 3k | — | ~855 | Automated safety check: Pass | MIT | |
| Securitytelagod/code-abyss | 243 | — | ~907 | Automated safety check: Pass | MIT | |
| Gha Security Reviewgetsentry/skills | 1k | 3 repos | ~2.2k | Automated safety check: Notes | Apache-2.0 | |
| Csono-session/pstack | 135 | — | ~12k | Automated safety check: Notes | MIT | |
| Moai Ref Secopsmodu-ai/moai-adk | 1.2k | — | ~2.6k | Automated safety check: Pass | Apache-2.0 | |
| Securing Systemstelagod/code-abyss | 243 | — | ~581 | Automated safety check: Pass | MIT |
Similar skills
- Official
Gha Security Review
getsentry/skills
GitHub Actions security review for workflow exploitation vulnerabilities.
Cso
no-session/pstack
Chief Security Officer mode. An agent skill from no-session/pstack.
Moai Ref Secops
modu-ai/moai-adk
DevSecOps, container, and API operational defensive security reference: CI/CD pipeline hardening, secret scanning, IaC misconfiguration detection, SAST/DAST integration, container image scanning…
Securing Systems
telagod/code-abyss
Security engineering router for penetration testing, code auditing, red/blue/purple team operations, threat intelligence, and vulnerability research.
Security Audit 2
sundial-org/awesome-openclaw-skills
Fail-closed security auditing for OpenClaw/ClawHub skills & repos: trufflehog secrets scanning, semgrep SAST, prompt-injection/persistence signals, and supply-chain hygiene checks before enabling or…
More from samugit83/redamon
All 15 skills in this repoAdd Community Skill
samugit83/redamon
Adding a Community Agent Skill: a Markdown attack-workflow file that users import from the catalog, which then competes in the Intent Router and is injected into the agent's system prompt.
Add Partial Recon
samugit83/redamon
Adding partial-recon support for a tool: running a single pipeline phase on demand from the workflow graph, reading its inputs from the existing Neo4j graph and merging results back.
Agentic Tool Integration
samugit83/redamon
Wiring a new tool the AI agent can call (not the recon pipeline): the tool registry, the phase map, the hardcoded dispatch chokepoint, and the duplicated execution paths that make a tool work in…
Builtin Agent Skill
samugit83/redamon
Adding a built-in Agent Skill (an attack technique like ssrf, xxe, rce) that ships hardcoded in RedAmon: classified by the Intent Router, injected into the agent prompt, toggled per project, badged…
Graph DB Writes
samugit83/redamon
Writing to the Neo4j attack-surface graph in RedAmon: the tenant-isolation MERGE key every entity node must carry, where graph methods live (mixins, not the client), and the schema places that must…
LLM Provider Integration
samugit83/redamon
Adding an LLM provider to RedAmon: the credential boundary (keys must never reach scan containers), prefix-routed model ids, and the provider registry.
Related
Categories
Questions about Supply Chain Scan
What does Supply Chain Scan do?
Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the…. Supply Chain Scan is an agent skill from samugit83/redamon. Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the hardened scanner, and the soft-error markers that record what was never analysed.
When should I use Supply Chain Scan?
Supply Chain Scan fits situations like: tasks that involve Supply chain security; tasks that involve Penetration testing; tasks that involve Secrets management.
How do I install Supply Chain Scan in Claude Code?
Run `npx skills add samugit83/redamon --skill supply-chain-scan -a claude-code`. Or copy the skill folder (skills/supply-chain-scan in samugit83/redamon) into .claude/skills/supply-chain-scan in your project. Claude Code loads it when a task matches its description.
How do I install Supply Chain Scan in Codex?
Run `npx skills add samugit83/redamon --skill supply-chain-scan -a codex`. Or copy the skill folder (skills/supply-chain-scan in samugit83/redamon) into .agents/skills/supply-chain-scan in your project. Codex loads it when a task matches its description.
Can I use Supply Chain Scan in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add samugit83/redamon --skill supply-chain-scan -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/supply-chain-scan, .gemini/skills/supply-chain-scan, .github/skills/supply-chain-scan and .opencode/skills/supply-chain-scan in your project.
What does Supply Chain Scan need to run?
SKILL.md names no scripts, command-line tools or credentials: Supply Chain Scan is instructions for the agent only.
Does Supply Chain Scan access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Supply Chain Scan safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Supply Chain Scan use?
Supply Chain Scan is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Supply Chain Scan use?
About 855 tokens (SKILL.md is roughly 3.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Supply Chain Scan?
Skills that share tags, products or a category with Supply Chain Scan: Security (telagod/code-abyss, 243 stars), Gha Security Review (getsentry/skills, 1k stars), Cso (no-session/pstack, 135 stars) and Moai Ref Secops (modu-ai/moai-adk, 1.2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Supply Chain Scan?
samugit83 (a GitHub user) maintains it in samugit83/redamon, which has 2,978 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on October 8, 2026.
Source: samugit83/redamon on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.