How do I install the Forge Supply Chain skill?

Run npx skillmds@latest add is-bo/forge-supply-chain-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Forge Supply Chain skill do?

Inspect dependencies, build integrity, provenance, releases, licenses, actions, and secret exposure across the delivery chain. It is listed under Security on SkillMD.

Is Forge Supply Chain safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Forge Supply Chain?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Forge Supply Chain free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Forge Supply Chain?

is-bo (@is-bo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Forge Supply Chain by is-bo — Agent Skill

Name: Forge Supply Chain
Author: is-bo

File contents

Fullstack Forge adapter: forge-supply-chain

This file is a pointer maintained by Fullstack Forge. It exists so this agent host can discover and trigger the skill. The full playbook is not duplicated here: one canonical copy is shared by every installed host.

Read the canonical playbook now and follow it exactly:

../../../.fullstack-forge/skills/forge-supply-chain/SKILL.md

That path is relative to this file. From the installation root it is .fullstack-forge/skills/forge-supply-chain/SKILL.md. Every resource the playbook references (fullstack-forge/references/..., fullstack-forge/schemas/..., fullstack-forge/templates/..., fullstack-forge/profiles/...) resolves relative to .fullstack-forge/skills/. The canonical playbook owns any deterministic composition step; perform that step exactly once. This adapter never adds a second workflow or composition command.

Do not edit this adapter; edit the canonical playbook instead. If the canonical file is missing or unreadable the installation is damaged. Report it and repair through the same project-package, archive, or plugin mechanism that installed this adapter. Never fall back to an unpinned npx forge, which may resolve an unrelated public package.

Frequently asked questions

Forge Supply Chain