Supply Chain Security

Supply Chain Security from uw-ssec/rse-plugins.

by @uw-ssec 6 skills

Install

npx skillmds@latest add plugin:uw-ssec/supply-chain-security

One command, no setup. In Claude Code it lands as a managed plugin you can enable, disable or remove with /plugin. On any other agent it installs the 6 skills into that agent's own folder.

Or inside Claude Code

In the Plugins tab, add this marketplace:

skillmds/skillmd
/plugin install uw-ssec-supply-chain-security@skillmd

Adds the marketplace once; later plugins need the second line only.

Or install by hand

Download the plugin and unzip its skills/ folder into your agent's skills directory. Works with every agent, no CLI needed.

Download plugin Paths per agent

Just the markdown? SKILL.md files only.

This plugin

skills: 6
authors: 1

Published by a registry member. Review its skills before installing.

Skills in this plugin

▌
Supply Chain Hardened CI CD · uw-ssec
Hardened GitHub Actions release workflow patterns for supply-chain security. Use when reviewing or writing GitHub Actions release workflows (.github/workflows/*.yml). Contains SHA-pinning, OIDC trusted publishing, two-job build/publish split, --ignore-scripts, Pwn Request prevention, deny-by-default permissions, and egress hardening patterns. Triggered by March 2026 TeamPCP campaign that specifically hijacked release tags.

0 installs
▌
Supply Chain Sbom Provenance · uw-ssec bundle
SBOM generation and provenance verification for research software releases. Use when reviewing or writing release workflows that publish to PyPI, npm, GHCR, or similar registries; when verifying a downstream artifact's signatures or attestations; or when evaluating SLSA level for a release pipeline. Covers CycloneDX/SPDX SBOM generation with syft, Sigstore keyless signing with cosign, npm provenance, and SLSA build levels.

0 installs
▌
Supply Chain Ecosystem Quirks · uw-ssec bundle
Ecosystem-specific supply-chain gotchas for npm, PyPI, conda/pixi, cargo, and Go. Use when reviewing package.json + .npmrc, pyproject.toml + setup.py, pixi.toml + conda-lock.yml, Cargo.toml + .cargo/config.toml, or go.mod + GOPROXY config — any time a supply-chain recommendation depends on which ecosystem you're in. Loads ecosystem-specific reference docs on demand.

0 installs
▌
Supply Chain Threat Awareness · uw-ssec bundle
Supply chain threat posture assessment for projects and packages. Use when reviewing a project's .github/workflows/*.yml, package.json, pyproject.toml, requirements.txt, pixi.toml, or lockfiles for exposure to active 2025–2026 campaigns. Covers Shai-Hulud (500+ npm packages), TeamPCP (Trivy, Checkmarx, LiteLLM, Bitwarden CLI, SAP CAP via tag hijacking), axios (100M weekly downloads), and LiteLLM .pth persistence — all attack patterns CVE scanners miss.

0 installs
▌
Supply Chain Incident Response · uw-ssec bundle
Incident-response runbook for supply-chain compromises. Use when an advisory, CVE, GHSA, or campaign report names a dependency or GitHub Action this project uses; when responding to a Shai-Hulud-style maintainer takeover; or when a TeamPCP-style tag hijack is reported. Walks the lockfile-check → CI-cache-check → secret-rotation → persistence-artifact-hunt 4-point check end-to-end.

0 installs
▌
Supply Chain Dependency Security · uw-ssec
Dependency and lockfile supply-chain security review with 2025–2026 attack campaign patterns. Use when reviewing package.json, pyproject.toml, requirements.txt, pixi.toml, conda-lock.yml, or any lockfile; when evaluating a new dependency for addition; or when responding to a supply-chain compromise incident. Contains patterns for detecting maintainer-account-takeover style attacks that CVE scanners miss.

0 installs