# Review Supply Chain > Review supply-chain and code-execution risks Use when this capability is needed. - Skill: `tomevault-io/review-supply-chain` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/review-supply-chain` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/review-supply-chain/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/review-supply-chain --- # Supply-chain / execution safety review Review the codebase for supply-chain risk and untrusted-code execution paths. ## Focus areas - Where the tool **executes** external commands (npm, npx, git, shell) - Where it **downloads/installs** dependencies at runtime - Template copying / vendored code: how integrity/origin is verified - Lockfiles and reproducibility (`npm ci` vs `npm install`) - Symlink/path traversal risks when executing within project directories ## Output format 1. **Attack surface inventory** (commands + cwd + trust boundary) 2. **High-risk findings** (with file paths) 3. **Minimal mitigations** (ordered) - pin versions/lockfile, avoid `npx`, run `npm run`, symlink rejection, integrity checks $ARGUMENTS --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/yida29) — claim your Tome and manage your conversions.