Supply Chain Gate

Supply Chain Gate

Keep merges and publishes policy-clean under Socket + npm audit — not chase literal 100s on every package-health gauge when the product needs fs / spawn.

Principles

• Gates over vanity scores — block malware, install scripts, exotic deps; monitor expected CLI capabilities (filesystem, shell for create-adsk).
• Evidence first — read the Socket PR comment / Alerts list before changing code.
• No new High risk without justification — document in the PR if you must.
• Pins for published packages — exact versions on create-adsk production deps.

Procedure

1. Classify the ask

2. Decide

1. Map each alert to block / warn / monitor using references/policy-allowlist.md (or SECURITY.md → “Socket policy” in this kit).
2. Fix blockers (remove script, replace dep, pin version, drop git URL) or stop and ask the user before adding a policy exception.
3. Re-run evidence: Socket check green, and npm ci && npm audit --audit-level=high when the change touches the lockfile.

3. Report before done

• Alert types listed with block/warn/monitor stance
• Policy source cited — references/policy-allowlist.md and/or repo SECURITY.md (Socket policy section); name the specific Socket alert/finding triaged, not just the policy doc; do not triage by vibes alone
• Code or policy change named (or explicit “no change; cool-down only”)
• Manual Socket dashboard / secret steps called out if still required
• Near-miss: hand off Dependabot YAML, release-please, or DevOps strategy

Progressive disclosure

/setup-socket is a thin Cursor wrapper that invokes this skill.

Near-miss handoff

• Dependabot config → upstream dependabot skill
• npm ignore-scripts / lockfile hardening primer → npm-security-best-practices
• Branching / envs / promotion → devops-strategy-facilitator
• Changelog / release-please → release-automation