Agent skill · security · davila7
supply-chain-guard
Detect and remediate software supply chain attacks in npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines by scanning for known compromised packages, malicious versions, filesystem IOCs, C2 indicators, and CI/CD misconfigurations.
Why this skill is useful
Adds executable scripts for comprehensive supply chain audits and remediation processes that are not commonly known or documented.
What it needs
Requires bash installed locally. About 4k tokens when loaded. Last updated 2026-08-06. 30,138 stars on the source repository.
What this skill does
Supply Chain Guard Automated detection and remediation of software supply chain attacks across npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines. Built from real-world attack intelligence gathered through March 31, 2026. When to Use This Skill Use this skill when: The user asks to audit a project's dependencies for security issues Before deploying code to production When investigating a potential supply chain compromise When the user mentions a recent supply chain attack and wants to check their projects As a regular security check in development workflows When setting up CI/CD pipelines and wanting to harden them When a new supply chain attack is reported and the user wants to verify exposure Instructions Step 1: Understand the Project Identify what the user's project uses: Node.js/npm: Look for package.json, package-lock.json, yarn.lock, pnpm-lock.yaml Python/PyPI: Look for requirements.txt, Pipfile, pyproject.toml, poetry.lock Rust/crates.io: Look for Cargo.toml, Cargo.lock CI/CD: Look for .github/workflows/, Dockerfile, docker-compose.yml Step 2: Run the Appropriate Scanners The skill includes three specialized scanners plus a unified runner. All scripts are in the scripts/ directory. Full audit (recommended): Individual scanners: Each scanner checks for: 1. Known compromised packages — exact matches against the IOC database 2. Malicious versions — specific version numbers known to contain malware 3. Filesystem IOCs — persistence mechanisms left by attackers 4. Network IOCs — C2 domains and IPs in source code 5. CI/CD misconfigurations — unpinned actions, dangerous triggers, exposed secrets 6. Credential exposure — npm tokens, PyPI credentials, .env files Step 3: Interpret Results Scanners exit with the number of issues found (0 = clean). Issues are categorized: [CRITICAL] — Known malicious package or active IOC detected. Immediate action required. [WARNING] — Security concern that needs investigation. May not be an active compromise. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills davila7/supply-chain-guard