supply-chain-guard

原文涵盖的主题

• Supply Chain Guard
• When to Use This Skill
• Instructions
• Step 1: Understand the Project
• Step 2: Run the Appropriate Scanners
• Step 3: Interpret Results
• Step 4: Remediate
• If a compromised package is found:

Automated detection and remediation of software supply chain attacks across npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines. Built from real-world attack intelligence gathered through March 31, 2026. Use this skill when: The user asks to audit a project's dependencies for security issues Before deploying code to production When investigating a potential supply chain compromise When the user mentions a recent supply chain attack and wants to check their projects As a regular security check in development workflows When setting up CI/CD pipelines and wanting to harden them When a new supply chain attack is reported and the user wants to verify exposure Identify what the user's project uses: Node.js/npm: Look for package.json, package-lock.json, yarn.lock, pnpm-lock.yaml Python/PyPI: Look for requirements.txt, Pipfile, pyproject.toml, poetry.lock Rust/crates.io: Look for Cargo.toml, Cargo.lock CI/CD: Look for .github/workflows/, Dockerfile, docker-compose.yml The skill includes three specialized scanners plus a unified runner. All scripts are in the scripts/ directory. Full audit (recommended): Individual scanners: Each scanner checks for: 1. Known compromised packages — exa

这里只展示节选，请以完整原文和当前要求为准。