Update Vulndb
boostsecurityio/poutine
Update the embedded build platform vulnerability database from the CVE Project's cvelistV5 repository.
A skill your agent uses for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
Install Supply Chain Security
The automated check flagged lines worth reading first. See the safety section below.
$ npx skills add zhaoxuya520/reverse-skill --skill supply-chain-security -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install zhaoxuya520/reverse-skill supply-chain-security --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/supply-chain-security .claude/skills/supply-chain-security && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "supply-chain-security" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/supply-chain-security into .claude/skills/supply-chain-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-security", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/supply-chain-securityType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add zhaoxuya520/reverse-skill --skill supply-chain-security -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install zhaoxuya520/reverse-skill supply-chain-security --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/supply-chain-security .agents/skills/supply-chain-security && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "supply-chain-security" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/supply-chain-security into .agents/skills/supply-chain-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-security", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaoxuya520/reverse-skill --skill supply-chain-security -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install zhaoxuya520/reverse-skill supply-chain-security --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/supply-chain-security .cursor/skills/supply-chain-security && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "supply-chain-security" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/supply-chain-security into .cursor/skills/supply-chain-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-security", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/zhaoxuya520/reverse-skill.git --path skills/supply-chain-security--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add zhaoxuya520/reverse-skill --skill supply-chain-security -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install zhaoxuya520/reverse-skill supply-chain-security --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/supply-chain-security .gemini/skills/supply-chain-security && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "supply-chain-security" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/supply-chain-security into .gemini/skills/supply-chain-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-security", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install zhaoxuya520/reverse-skill supply-chain-securityInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add zhaoxuya520/reverse-skill --skill supply-chain-security -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/supply-chain-security .github/skills/supply-chain-security && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "supply-chain-security" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/supply-chain-security into .github/skills/supply-chain-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-security", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaoxuya520/reverse-skill --skill supply-chain-security -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install zhaoxuya520/reverse-skill supply-chain-security --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/supply-chain-security .opencode/skills/supply-chain-security && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "supply-chain-security" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/supply-chain-security into .opencode/skills/supply-chain-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supply-chain-security", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
supply-chain-security- GitHub stars
- 40k
- Used in
- 4 other repos
- Token cost
- ~953 tokens
- SKILL.md length
- 157 words
- Files
- 3 (incl. references)
- Skills in repo
- 19
- Repo updated
- First seen
- Licence
- MIT
At a glance
A skill your agent uses for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
- Works in 6 steps: SBOM 生成与审计 → 软件组成分析（SCA） → 漏洞可达性验证 → …
- Software supply-chain security assessment covering SBOM
- SKILL.md covers ACTION REQUIRED（读完后立刻执行）, 适用场景, 六层供应链治理框架 and 工作流, plus 3 more sections
- Calls trivy, docker and go; reaches raw.githubusercontent.com
What it does
Supply Chain Security is an agent skill from zhaoxuya520/reverse-skill. Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
Its SKILL.md is about 950 tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files, including reference files (for example `references/cicd-pipeline-security.md` and `references/sbom-sca-methodology.md`).
It sits in Security, covering Supply chain security and CI/CD. It works with GitHub and Snyk. The repository describes itself as: Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base…. The licence is MIT.
When your agent uses it
- Software supply-chain security assessment covering SBOM
- CI/CD pipelines
- Container images
- Build integrity
Example prompts
- “/supply-chain-security”
Requirements
- Node.js
- Docker
Workflow steps
6 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit cab634b. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
trivydockergonpmhadolintaptcurl
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
raw.githubusercontent.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Supply Chain Security loads about 953 tokens when it runs, and up to ~2.3k if it reads all its reference files. Until then it costs about 50 tokens; SKILL.md has 157 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: warnings
The automated check found patterns that need a careful read before installing.
- WarningTells the agent its actions are pre-authorized / not to stop for confirmationSKILL.md:9
/precedent-pentest.md` — 确认本 skill 的操作是已授权的常规操作
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from zhaoxuya520/reverse-skill at commit cab634b, republished under its MIT licence (© zhaoxuya520). 157 words, ~953 tokens.
Download SKILL.mdSave it as
.claude/skills/supply-chain-security/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.- name
- supply-chain-security
- description
- Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
Supply Chain Security Testing
ACTION REQUIRED（读完后立刻执行）
NOW: 读取../field-journal/precedent-pentest.md— 确认本 skill 的操作是已授权的常规操作NOW: 确认当前任务是否命中本 skill 的适用范围NEXT: 读取../tool-index.md，校验工具可用性和实际路径NEXT: 缺工具时调用 bootstrap，不要猜路径ACT: 进入"工作流"第一步并执行，不要停在确认状态
SBOM / SCA / CI/CD 管道 / 依赖溯源 法规驱动：美国行政令 SBOM、中国国标、EU CRA
适用场景
- 软件供应链安全评估
- 开源依赖漏洞扫描与验证
- CI/CD 管道安全审计
- 容器镜像安全分析
- 第三方组件合规审查
- 构建产物溯源与完整性验证
六层供应链治理框架
Layer 1: 源码信任评估 → 上游仓库/维护者/发布历史审查
Layer 2: 构建管道集成 → CI/CD 安全门禁、签名验证
Layer 3: 制品分发完整性 → 签名、校验和、SBOM 附加
Layer 4: 运行时保护 → 容器扫描、准入控制
Layer 5: 持续监控 → CVE 实时追踪、漏洞可达性分析
Layer 6: 事件响应 → 供应链攻击应急、回滚策略工作流
1. SBOM 生成与审计
生成 SBOM：
□ CycloneDX 格式: cdxgen → bom.json
□ SPDX 格式: sbom-tool generate
□ Syft: syft <image|dir> -o spdx-json
审计要点：
□ 是否存在未知/未授权的依赖
□ 是否存在已废弃/停止维护的包
□ 许可证冲突检测
□ 直接依赖 vs 传递依赖清单
□ 每个组件的发布时间线和维护者状态2. 软件组成分析（SCA）
# OSV-Scanner（免费、Google 维护）
osv-scanner scan -r . --format json
# OWASP Dependency-Track（企业级持续监控）
docker run -p 8080:8080 dependencytrack/apiserver
# → 上传 SBOM → 自动匹配 NVD/OSV/GitHub Advisory
# Snyk（商业）
snyk test --all-projects
snyk monitor # 持续监控
# Trivy（容器 + 依赖 + IaC）
trivy fs . # 文件系统扫描
trivy image nginx # 容器镜像
trivy config . # IaC 配置3. 漏洞可达性验证
SCA 告警 ≠ 实际风险！大多数 SCA 工具只有 ~15% 的告警是实际可达的。
验证步骤：
1. 用 Dependency-Track 或 Trivy 获取 CVE 列表
2. 筛选 CVSS ≥ 7.0 的漏洞
3. 对有 PoC 的 CVE 做可达性分析
- Code Property Graph 切片: 追踪用户输入到漏洞函数的路径
- DEPTEX 方法: EPD (Execution Path Dominance) + LLM 语义验证
4. 在隔离环境中验证 PoC
5. 对可达的漏洞按实际影响排序修复优先级工具参考：
- CodeQL: GitHub 代码查询 → 数据流分析
- Snyk Code: 可达性标记
- DEPTEX: LLM 辅助上下文感知风险评估
4. CI/CD 管道安全
安全检查点：
□ 代码提交 → pre-commit hook: gitleaks (密钥扫描)
□ PR 阶段 → SCA 扫描 (Trivy/OSV-Scanner)
□ 构建阶段 → 制品签名 (cosign)
□ 推送阶段 → SBOM 附加 (syft + attest)
□ 部署阶段 → 准入控制 (OPA/Kyverno + 镜像扫描)
□ 运行时 → 持续漏洞监控 (Dependency-Track)
管道自身安全：
□ Pipeline as Code 审计（GitHub Actions / GitLab CI 配置注入）
□ Runner 隔离（防止恶意构建突破容器）
□ 密钥管理（Actions Secrets / Vault，禁止硬编码）
□ 第三方 Action 审查（锁定 commit SHA，非 tag）5. 容器镜像安全
# Dockerfile 审计
hadolint Dockerfile
# 镜像扫描（多层：OS + 应用依赖 + 配置）
trivy image --severity HIGH,CRITICAL nginx:latest
# 最小基础镜像
# 优先: distroless → alpine → slim → 避免 latest
docker scout quickview nginx:latest
# 镜像签名
cosign sign --key cosign.key myimage:tag
cosign verify --key cosign.pub myimage:tag6. 第三方依赖审查
新增依赖 Checklist：
□ 维护状态：最近 6 个月有提交？维护者活跃度？
□ 安全历史：过去有无被植入恶意代码？
□ 依赖树：引入后新增多少传递依赖？
□ 许可证：与项目许可证兼容？
□ 替代方案：有无更安全的替代（Snyk Advisor / Socket.dev 评分）？
风险评估矩阵：
高维护 × 低依赖数 × 兼容许可证 → 低风险
低维护 × 高依赖数 × 许可证冲突 → 高风险工具链
| 工具 | 用途 | 获取 |
|---|---|---|
| OWASP Dependency-Track | 企业级持续 SCA | docker pull dependencytrack/apiserver |
| OSV-Scanner | 免费 SCA（OSV.dev 生态） | go install github.com/google/osv-scanner |
| Trivy | 镜像 + 依赖 + IaC 扫描 | apt install trivy |
| Syft | SBOM 生成 | curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh |
| cdxgen | CycloneDX SBOM 生成 | npm install -g @cyclonedx/cdxgen |
| Cosign | 容器签名 | go install github.com/sigstore/cosign/v2/cmd/cosign |
| Gitleaks | 密钥/凭证扫描 | go install github.com/gitleaks/gitleaks/v8 |
| Snyk | 商业 SCA + 可达性 | npm install -g snyk |
| CodeQL | 代码查询 + 数据流 | GitHub Actions 内置 |
参考
references/sbom-sca-methodology.md— SBOM + SCA 方法论references/cicd-pipeline-security.md— CI/CD 管道安全审计
任务完成自检（声称完成前 MUST 通过）
- 我是否执行了工作流中的每一步（而不是只阅读）？
- 我是否基于
tool-index使用了真实工具路径？ - 我是否产出了可复现证据（命令/脚本/截图/报告）？
- 我是否完成并回写了 RULES 要求的 Checklist 项？
© zhaoxuya520, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 2 other files (references) in skills/supply-chain-security of zhaoxuya520/reverse-skill.
- SKILL.md
- references/cicd-pipeline-security.md
- references/sbom-sca-methodology.md
Open the folder on GitHubat commit cab634b
Used in 4 other repositories
We found 8 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 4 other GitHub owners. This page covers the copy in zhaoxuya520/reverse-skill, which our catalogue first saw on October 7, 2026.
- dhicoc/dsh-reverse-skillskills/supply-chain-security
- sickn33/agentic-awesome-skillsskills/supply-chain-securityplugins/agentic-awesome-skills/skills/supply-chain-security+1 more
- lingxling/awesome-skills-cnantigravity-awesome-skills/skills/supply-chain-securityantigravity-awesome-skills/plugins/agentic-awesome-skills/skills/supply-chain-security+1 more
- coco-research/cocosystems/reverse-skill/skills/supply-chain-security
Compare with similar skills
Supply Chain Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Supply Chain Security this skillzhaoxuya520/reverse-skill | 40k | 4 repos | ~953 | Automated safety check: Warn | MIT | |
| Update Vulndbboostsecurityio/poutine | 523 | — | ~173 | Automated safety check: Pass | Apache-2.0 | |
| Implementing Sigstore For Software Signingmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.2k | Automated safety check: Notes | Apache-2.0 | |
| Vulnerability Scanningsecondsky/claude-skills | 227 | — | ~799 | Automated safety check: Pass | MIT | |
| GitHub Actions Supply Chain Pinningasyncapi/generator | 1.1k | — | ~1.9k | Automated safety check: Pass | Apache-2.0 | |
| Securing GitHub Actions Workflowsmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.2k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Implementing Sigstore For Software Signing
mukul975/Anthropic-Cybersecurity-Skills
Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic…
Vulnerability Scanning
secondsky/claude-skills
Automated security scanning for dependencies, code, containers with Trivy, Snyk, npm audit.
GitHub Actions Supply Chain Pinning
asyncapi/generator
A skill your agent uses when editing, adding, or reviewing any file under .github/workflows/, or when a CI step installs a CLI tool (npm i -g, npx, pipx, uses: /setup-).
Securing GitHub Actions Workflows
mukul975/Anthropic-Cybersecurity-Skills
Hardens GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation: pinning actions to SHA digests, minimizing GITHUBTOKEN permissions, protecting secrets…
Managing Vulnerabilities
ancoleman/ai-design-components
Implementing multi-layer security scanning (container, SAST, DAST, SCA, secrets), SBOM generation, and risk-based vulnerability prioritization in CI/CD pipelines.
More from zhaoxuya520/reverse-skill
All 19 skills in this repoDiagram Generator
zhaoxuya520/reverse-skill
Turns text, notes, code, schemas or tables into diagram source in Mermaid, Graphviz DOT, PlantUML or SVG, and renders files when you ask for an image or PDF.
Dsl Vm Reverse
zhaoxuya520/reverse-skill
Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines.
Browser Extension Reverse
zhaoxuya520/reverse-skill
A skill your agent uses for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic…
Go Rust Reverse
zhaoxuya520/reverse-skill
A skill your agent uses for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.
Identity Federation
zhaoxuya520/reverse-skill
A skill your agent uses for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
macOS Reverse
zhaoxuya520/reverse-skill
A skill your agent uses for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.
Related
Categories
Questions about Supply Chain Security
What does Supply Chain Security do?
A skill your agent uses for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability. Supply Chain Security is an agent skill from zhaoxuya520/reverse-skill. Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
When should I use Supply Chain Security?
Supply Chain Security fits situations like: software supply-chain security assessment covering SBOM; CI/CD pipelines; container images; build integrity.
How do I install Supply Chain Security in Claude Code?
Run `npx skills add zhaoxuya520/reverse-skill --skill supply-chain-security -a claude-code`. Or copy the skill folder (skills/supply-chain-security in zhaoxuya520/reverse-skill) into .claude/skills/supply-chain-security in your project. Claude Code loads it when a task matches its description.
How do I install Supply Chain Security in Codex?
Run `npx skills add zhaoxuya520/reverse-skill --skill supply-chain-security -a codex`. Or copy the skill folder (skills/supply-chain-security in zhaoxuya520/reverse-skill) into .agents/skills/supply-chain-security in your project. Codex loads it when a task matches its description.
Can I use Supply Chain Security in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaoxuya520/reverse-skill --skill supply-chain-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/supply-chain-security, .gemini/skills/supply-chain-security, .github/skills/supply-chain-security and .opencode/skills/supply-chain-security in your project.
What does Supply Chain Security need to run?
Going by SKILL.md and its folder, Supply Chain Security needs the command-line tools its instructions call (trivy, docker, go, npm, hadolint and apt). Our summary lists: Node.js; Docker.
Does Supply Chain Security access the network?
SKILL.md names 1 domain. In commands or code: raw.githubusercontent.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.
Is Supply Chain Security safe to install?
Our automated static check of SKILL.md flagged 1 warning(s): tells the agent its actions are pre-authorized / not to stop for confirmation. Read the flagged lines before installing; the check is not a guarantee either way.
What licence does Supply Chain Security use?
Supply Chain Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Supply Chain Security use?
About 953 tokens (SKILL.md is roughly 3.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.4k tokens, read only when the agent opens those files.
What are the alternatives to Supply Chain Security?
Skills that share tags, products or a category with Supply Chain Security: Update Vulndb (boostsecurityio/poutine, 523 stars), Implementing Sigstore For Software Signing (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Vulnerability Scanning (secondsky/claude-skills, 227 stars) and GitHub Actions Supply Chain Pinning (asyncapi/generator, 1.1k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Supply Chain Security?
zhaoxuya520 (a GitHub user) maintains it in zhaoxuya520/reverse-skill, which has 40,325 GitHub stars. The repository holds 19 skills in this directory. The repository was last updated on September 22, 2026.
Source: zhaoxuya520/reverse-skill on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.