supply-chain-security

Plugin supply-chain-security from marketplace rse-plugins in uw-ssec/rse-plugins. Commands read from the repo's manifest — 12 days ago.

Skills (6)

• supply-chain-dependency-security

  Dependency and lockfile supply-chain security review with 2025–2026 attack campaign patterns. Use when reviewing package.json, pyproject.toml, requirements.txt, pixi.toml, conda-lock.yml, or any lockfile; when evaluating a new dependency for addition; or when responding to a supply-chain compromise

• supply-chain-ecosystem-quirks

  Ecosystem-specific supply-chain gotchas for npm, PyPI, conda/pixi, cargo, and Go. Use when reviewing package.json + .npmrc, pyproject.toml + setup.py, pixi.toml + conda-lock.yml, Cargo.toml + .cargo/config.toml, or go.mod + GOPROXY config — any time a supply-chain recommendation depends on which eco

• supply-chain-hardened-ci-cd

  Hardened GitHub Actions release workflow patterns for supply-chain security. Use when reviewing or writing GitHub Actions release workflows (.github/workflows/*.yml). Contains SHA-pinning, OIDC trusted publishing, two-job build/publish split, --ignore-scripts, Pwn Request prevention, deny-by-default

• supply-chain-incident-response

  Incident-response runbook for supply-chain compromises. Use when an advisory, CVE, GHSA, or campaign report names a dependency or GitHub Action this project uses; when responding to a Shai-Hulud-style maintainer takeover; or when a TeamPCP-style tag hijack is reported. Walks the lockfile-check → CI-

• supply-chain-sbom-provenance

  SBOM generation and provenance verification for research software releases. Use when reviewing or writing release workflows that publish to PyPI, npm, GHCR, or similar registries; when verifying a downstream artifact's signatures or attestations; or when evaluating SLSA level for a release pipeline.

• supply-chain-threat-awareness

  Supply chain threat posture assessment for projects and packages. Use when reviewing a project's .github/workflows/*.yml, package.json, pyproject.toml, requirements.txt, pixi.toml, or lockfiles for exposure to active 2025–2026 campaigns. Covers Shai-Hulud (500+ npm packages), TeamPCP (Trivy, Checkma

Slash commands (5)

• /supply-chain-security:supply-chain-audit

  Audit a research software project's supply-chain security posture across .github/workflows/, lockfiles, install scripts, and persistence vectors. Read-only. Produces a structured Markdown report with FAIL/WARN/PASS findings, file:line citations, and prioritized actions linking to remediation command

• /supply-chain-security:supply-chain-harden-workflow

  Apply the supply-chain hardening playbook to a single GitHub Actions workflow file — deny-by-default permissions, per-job opt-in, two-job build/publish split where applicable, --ignore-scripts on install steps, harden-runner injection, and environment-gated publish job. Dry-run by default — pass --a

• /supply-chain-security:supply-chain-incident

  Walk through supply-chain incident response for an advisory, CVE, GHSA, package name, or campaign name. Engages the supply-chain-incident-responder agent. Performs the 4-point check (lockfile → CI cache → secrets → persistence) and produces a filled incident-report-template.md. Read-only.

• /supply-chain-security:supply-chain-lockfile-check

  Check lockfile health across all detected ecosystems (npm, PyPI, conda/pixi, cargo, Go). Verifies committed status, CI usage, hash pinning, floating versions, and cooldown discipline. Narrower than /supply-chain-audit. Read-only.

• /supply-chain-security:supply-chain-pin-actions

  Convert mutable GitHub Actions refs (@v4, @main, @latest) in .github/workflows/*.yml to 40-char commit SHAs with trailing tag comments. Dry-run by default — pass --apply to write. Refuses to apply when a SHA cannot be uniquely resolved or the ref is a branch name.

Subagents (2)

• supply-chain-incident-responder

  Incident-response specialist for active supply-chain compromises. Engages when an advisory, CVE, GHSA, or campaign report names a dependency or GitHub Action this project uses — Shai-Hulud-style maintainer takeovers, TeamPCP-style tag hijacks, or any active dependency advisory. Owns the lockfile-che

• supply-chain-security-expert

  Expert in defending research software against 2025-2026 supply-chain attacks. Covers GitHub Actions hardening, dependency hygiene, SBOM/provenance, threat posture, and ecosystem-specific gotchas (npm, PyPI, conda/pixi, cargo, Go).

Similar plugins