# Supply Chain Review

> Reviews lockfiles, installers, provenance, CI permissions, dependency confusion, artifacts, registries, and publishing.

- Skill: `mesteriis/supply-chain-review` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add mesteriis/supply-chain-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mesteriis/supply-chain-review/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Mesteriis (https://skillmd.com/u/mesteriis)
- Updated: 2026-08-19
- Page: https://skillmd.com/skills/mesteriis/supply-chain-review

---


# Supply Chain Review

Review how code and dependencies enter the build.

## Workflow

1. Inspect package manifests, lockfiles, CI workflows, release scripts, and
   build/publish configuration.
2. Identify install-time execution, unpinned sources, registry drift, generated
   artifacts, and privileged tokens.
3. Check whether changes widen permissions or provenance risk.
4. Recommend minimal hardening and validation.

## Output

- supply-chain surfaces
- risky changes or defaults
- affected workflow
- evidence
- remediation
- validation gaps

## Rule

Do not upgrade or rewrite the build unless the user asks for implementation.
Review first, then patch only when scoped.