How do I install the Supply Chain Security skill?

Run npx skillmds@latest add irahardianto/supply-chain-security-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Supply Chain Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Supply Chain Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Supply Chain Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Supply Chain Security?

irahardianto (@irahardianto) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Supply Chain Security by irahardianto

Name: Supply Chain Security
Author: irahardianto

File contents

Supply Chain Security Principles

Guidelines for securing the software supply chain.

When to Invoke

Auditing project dependencies
Setting up CVE scanning in CI/CD
License compliance review
Responding to supply chain vulnerability disclosures

Dependency Security

CVE Scanning

Language	Tool	Command
Go	`govulncheck`	`govulncheck ./...`
Rust	`cargo audit`	`cargo audit`
Python	`pip-audit`	`pip-audit`
Node.js	`npm audit`	`npm audit`
Java	OWASP Dependency-Check	`mvn dependency-check:check`
.NET	Built-in	`dotnet list package --vulnerable`
Ruby	`bundle audit`	`bundle audit check --update`
PHP	`composer audit`	`composer audit`

Scanning Frequency

Every CI run — fail build on critical/high CVEs
Weekly scheduled scan — catch newly disclosed vulnerabilities
On dependency update — verify new version is clean

SBOM (Software Bill of Materials)

Generation

# CycloneDX format (recommended)
# Go
cyclonedx-gomod mod -json -output sbom.json

# Node.js
npx @cyclonedx/cyclonedx-npm --output-file sbom.json

# Python
cyclonedx-py poetry --format json -o sbom.json

Usage

Attach SBOM to releases
Track all transitive dependencies
Enable downstream vulnerability analysis

License Compliance

Risk Levels

License	Risk	Action
MIT, BSD, Apache 2.0	Low	Permissive — generally safe
LGPL	Medium	Review linking requirements
GPL	High	Copyleft — may require source disclosure
AGPL	Critical	Network copyleft — consult legal
No license	Critical	Cannot use — no rights granted

Automation

Use license-checker (Node.js), pip-licenses (Python), cargo-license (Rust)
Maintain allowlist/denylist of approved licenses
Fail CI on disallowed licenses

Supply Chain Attack Prevention

Lock files committed — package-lock.json, go.sum, Cargo.lock, poetry.lock
Pin exact versions in production — no floating ranges
Verify checksums — lock files contain integrity hashes
Review new dependencies — check maintainer, downloads, last commit, open issues
Minimal dependencies — each dep = increased attack surface
Signed commits and releases — verify artifact provenance

Dependency Management Principles @.agents/rules/dependency-management-principles.md
Security Principles .agents/rules/security-principles.md
Security Mandate .agents/rules/security-mandate.md

---name: supply-chain-security-2description: SBOM generation, CVE scanning, supply chain attack detection, license compliance, dependency pinning, and artifact verification.---# Supply Chain Security PrinciplesGuidelines for securing the software supply chain.## When to Invoke- Auditing project dependencies- Setting up CVE scanning in CI/CD- License compliance review- Responding to supply chain vulnerability disclosures## Dependency Security### CVE Scanning| Language | Tool | Command ||---|---|---|| Go | `govulncheck` | `govulncheck ./...` || Rust | `cargo audit` | `cargo audit` || Python | `pip-audit` | `pip-audit` || Node.js | `npm audit` | `npm audit` || Java | OWASP Dependency-Check | `mvn dependency-check:check` || .NET | Built-in | `dotnet list package --vulnerable` || Ruby | `bundle audit` | `bundle audit check --update` || PHP | `composer audit` | `composer audit` |### Scanning Frequency- **Every CI run** — fail build on critical/high CVEs- **Weekly scheduled scan** — catch newly disclosed vulnerabilities- **On dependency update** — verify new version is clean## SBOM (Software Bill of Materials)### Generation```bash# CycloneDX format (recommended)# Gocyclonedx-gomod mod -json -output sbom.json# Node.jsnpx @cyclonedx/cyclonedx-npm --output-file sbom.json# Pythoncyclonedx-py poetry --format json -o sbom.json```### Usage- Attach SBOM to releases- Track all transitive dependencies- Enable downstream vulnerability analysis## License Compliance### Risk Levels| License | Risk | Action ||---|---|---|| MIT, BSD, Apache 2.0 | Low | Permissive — generally safe || LGPL | Medium | Review linking requirements || GPL | High | Copyleft — may require source disclosure || AGPL | Critical | Network copyleft — consult legal || No license | Critical | Cannot use — no rights granted |### Automation- Use `license-checker` (Node.js), `pip-licenses` (Python), `cargo-license` (Rust)- Maintain allowlist/denylist of approved licenses- Fail CI on disallowed licenses## Supply Chain Attack Prevention1. **Lock files committed** — `package-lock.json`, `go.sum`, `Cargo.lock`, `poetry.lock`2. **Pin exact versions** in production — no floating ranges3. **Verify checksums** — lock files contain integrity hashes4. **Review new dependencies** — check maintainer, downloads, last commit, open issues5. **Minimal dependencies** — each dep = increased attack surface6. **Signed commits and releases** — verify artifact provenance## Related- Dependency Management Principles @.agents/rules/dependency-management-principles.md- Security Principles .agents/rules/security-principles.md- Security Mandate .agents/rules/security-mandate.md

Frequently asked questions

Supply Chain Security