Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/sebastienrousseau/pain001/python-supply-chaingit clone --depth 1 https://github.com/sebastienrousseau/pain001Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/sebastienrousseau/pain001/python-supply-chain)<a href="https://agentmods.dev/agents/sebastienrousseau/pain001/python-supply-chain"><img src="https://agentmods.dev/badge/agents/sebastienrousseau/pain001/python-supply-chain.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.03020 |
| Opus 5 | $0.00000 | $0.01510 |
| Sonnet 5 | $0.00000 | $0.00604 |
| Haiku 4.5 | $0.00000 | $0.00302 |
Grade C, and why
python-supply-chain scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh How it starts
The opening of the file, as written. The whole thing — 395 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Python Supply Chain Security Tollgate
Mission
Prevent supply chain attacks and ensure dependency integrity in payment processing.
Tollgate Objectives
- Enforce SBOM (Software Bill of Materials) generation
- Validate dependency licenses (no GPL, AGPL)
- Check known CVEs in dependencies (zero tolerance)
- Verify dependency signatures and checksums
- Detect typosquatting and malicious packages
When This Tollgate Applies
- Adding new dependencies to
pyproject.toml - Updating existing dependencies
- Before every release
- Monthly security audits
Tollgate Checks
1. SBOM Generation (MANDATORY for Releases)
# Option 1: Use Syft (external CLI - no GPL dependencies)
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh
syft packages dir:. -o cyclonedx-json > sbom.json
# Option 2: Use pip-licenses for simple license audit
poetry run pip-licenses --format=json --with-urls > licenses.json
# Option 3: Use Trivy (Docker/GitHub Actions)
trivy fs --format cyclonedx --output sbom.json .
# Output: sbom.json (Software Bill of Materials)
# Contains: All dependencies, versions, licenses, checksums
Success Criteria:
- SBOM generated successfully
- All dependencies listed with versions
- Licenses identified for all packages
- Checksums present
Note: We use external SBOM tools instead of Python packages (e.g., cyclonedx-bom) to avoid GPL-licensed transitive dependencies (rfc3987). See Case Study below.
2. License Compliance (MANDATORY)
# Check all dependency licenses
poetry run pip-licenses --format=markdown --with-urls \
--fail-on="GPL;AGPL;SSPL;Commons Clause"
# Allowed licenses:
# - MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause
# - ISC, PSF, MPL-2.0
# - LGPL (acceptable for library use - no linking restrictions for Python)
# - Multi-licensed (e.g., BSD/GPL/PSF - use non-copyleft option)
# Forbidden licenses:
# - GPL v2+, GPL v3+ (strong copyleft - incompatible with Apache 2.0)
# - AGPL (network copyleft - incompatible with Apache 2.0)
# - SSPL (non-OSI approved)
# - Commons Clause (restricts commercial use)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 395 lines · 0 tokens per session scan C d13f7f821bf2
python-supply-chain is an agent published in the GitHub repository sebastienrousseau/pain001 (49 stars, last pushed 4d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 3,020 tokens. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
fintech-compliance-auditor
AI agent for financial technology compliance and security standards.
mp-integration-expert
Use when implementing, reviewing, or debugging any Mercado Pago payment integration. Routes requests to one of four skills, supports offline scaffolding and local checks, and connects to MCP only immediately before a selected live tool.
payment-integrator
Specialist for Taiwan payment gateway integration, supporting NewebPay, ECPay, and PAYUNi.
apra-mcp-expert
Use when the user asks about Australian banking, superannuation, or insurance prudential data — bank capital ratios, RWA, super fund member counts and assets, post-AASB17 life and general insurance metrics. Translates plain-English questions into apra-mcp tool calls.
ecommerce-optimization-expert
AI agent for e-commerce platform optimization and conversion rate improvement.
context
You are the Context agent. Your job is memory and context-window management: decide what to keep, compact, or recall so the working context stays high-signal and within budget.