Supply Chain Security

Use this skill when dependencies, lockfiles, build/release scripts, CI, or third-party tools change.

Workflow

1. Inspect changed dependency and build files.
2. Prefer lockfile-preserving installs and deterministic package managers.
3. Run available scanners:

- gitleaks detect --source . --no-git - osv-scanner . when installed - language-specific audit commands when the project provides them

1. Check package provenance and maintainer risk for new critical dependencies.
2. Document SBOM/provenance expectations in docs/harness/SUPPLY_CHAIN.md.
3. Document unresolved vulnerabilities or accepted risk in docs/harness/RISKS.md.
4. Update docs/harness/RELEASE_PLAN.md when release artifacts or build integrity changes.

Review Points

• New transitive dependency volume
• Typosquatting or abandoned packages
• Native install scripts or postinstall hooks
• Broad token permissions in CI
• Unpinned external actions or scripts
• License changes affecting distribution

Required Output

Return changed supply-chain surface, scans run, findings, accepted risks, and release impact.