supplychain

Plugin supplychain from marketplace eyesecurity in eyesecurity/skills. Commands read from the repo's manifest — 28 days ago.

Skills (4)

• supplychain

  Supply-chain security for JavaScript and Python projects — npm, pnpm, Yarn v2+, uv, pip, Poetry, pdm, and GitHub Actions CI. Router skill: detects which ecosystems a project uses and dispatches to the matching sub-skill under skills/. Read this first, then read only the sub-skill(s) the project actu

• ci-audit

  Audits npm and PyPI supply-chain hardening in GitHub Actions workflows. Primary focus on how the project's package manager is invoked in CI — install commands, registry integrity, manager version pinning, publish flow (OIDC + provenance / attestations), and uncontrolled install surface (npx, pipx, g

• npm-harden

  Hardens npm, pnpm, and Yarn v2+ projects against supply chain attacks. Audits package manager configuration, version pinning, and lockfile hygiene to protect the npm supply chain. Trigger with /supplychain:npm-harden or /supplychain:npm-harden <path>.

• pypi-harden

  Hardens Python projects against PyPI supply chain attacks. Audits installer configuration (uv, pip, Poetry, pdm), version pinning, lockfile + hash hygiene, release-age gate, sdist execution policy, and index integrity. Trigger with /supplychain:pypi-harden or /supplychain:pypi-harden <path>.