gabrielmoreira Supply Chain Review
Core Workflow
- Identify the source, publisher, version, commit, license, install path, and update mechanism.
- Review dependencies, package managers, install commands, remote downloads, generated code, and executable artifacts.
- Check whether versions and sources are pinned, inspectable, and reproducible.
- Look for typosquatting, untrusted domains, opaque binaries, install hooks, telemetry surprises, or broad permissions.
- Recommend pinning, vendoring, removal, manual review, or blocked install.
- Record approval conditions and re-review triggers.
Safety Rules
- Do not install or execute third-party packages just to inspect them.
- Do not trust stars, downloads, or marketplace position as safety proof.
- Do not approve remote script execution without source review and a clear rollback path.
Deliverable Shape
For supply-chain reviews, provide:
- Source and provenance
- Dependencies and install path
- Pinning and reproducibility notes
- Suspicious or opaque components
- License and update concerns
- Approval conditions
- Safe install recommendation
References
- Read
references/supply-chain-review-checklist.mdwhen reviewing third-party skill sources, dependencies, or install steps.