Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add contactandrewchl-wq/turtle-mcp --skill security-supply-chaingit clone --depth 1 https://github.com/contactandrewchl-wq/turtle-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/contactandrewchl-wq/turtle-mcp/security-supply-chain)<a href="https://agentmods.dev/skills/contactandrewchl-wq/turtle-mcp/security-supply-chain"><img src="https://agentmods.dev/badge/skills/contactandrewchl-wq/turtle-mcp/security-supply-chain/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/contactandrewchl-wq/turtle-mcp/security-supply-chain"><img src="https://agentmods.dev/badge/skills/contactandrewchl-wq/turtle-mcp/security-supply-chain.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.01139 |
| Opus 5 | $0.00028 | $0.00570 |
| Sonnet 5 | $0.00011 | $0.00228 |
| Haiku 4.5 | $0.00006 | $0.00114 |
Grade B, and why
security-supply-chain scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codemediumSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- **Sin descargas `curl | sh`** sin checksum / firma verificada. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Sin descargas `curl | sh`** sin checksum / firma verificada. How it starts
The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Supply chain security
Cuándo usar
- Agregar o actualizar una dependencia.
- Configurar CI/CD o un pipeline de publicación.
- Diseñar el proceso de release.
Por qué importa
Una dependencia comprometida ejecuta código en tu build, en tus tests y en
producción. Históricos: event-stream, colors.js/faker.js, xz-utils (CVE-2024-3094),
typosquatting masivo en npm/PyPI.
Reglas duras
- Lockfile commiteado siempre.
package-lock.json,Cargo.lock,poetry.lock,pnpm-lock.yaml,go.sum. - Sin instalar
latesten runtime. Pinneá versiones; actualizá con PR. - Sin
npm installsin lockfile en CI. Usánpm ci,pnpm install --frozen-lockfile,cargo install --locked. - Sin scripts
postinstallde paquetes no auditados en entornos sensibles.npm install --ignore-scriptscuando se pueda. - Sin descargas
curl | shsin checksum / firma verificada.
Auditoría continua
npm audit/pnpm audit/yarn auditcargo audit(Rust)pip-audit(Python)osv-scanner(multi-ecosistema, base OSV)govulncheck(Go)bundler-audit(Ruby)
Corré en CI y bloqueá merges con vulnerabilidades altas/críticas sin justificación.
SBOM
Generá un Software Bill of Materials por release:
syft/cyclonedxpara generación.- Formato: CycloneDX o SPDX (estándar).
- Almacenalo junto al artefacto en el release.
Si te llaman por un CVE de una dep, tener SBOM = saber qué releases están afectados en minutos, no días.
Firmas y verificación
- Verificá firmas de artefactos descargados: GPG, sigstore/cosign, Apple notarization.
- Firmá tus releases:
cosign signpara imágenes y binarios. - Para SLSA L3+: build reproducible + provenance attestation.
Dependencias — antes de agregar una
Checklist rápido:
- ¿La necesitamos o lo hace el lenguaje/runtime?
- ¿Está mantenida? (último commit, issues abiertos, downloads).
- ¿Cuántas deps trae transitivamente? Más = más superficie.
- ¿Tiene licencia compatible con la nuestra?
- ¿Hay versión LTS o solo
0.0.x? - ¿La organización detrás es identificable?
- ¿Hay alternativa ya en uso en el repo?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 115 lines · 57 tokens per session scan B addf89920051
security-supply-chain is a skill published in the GitHub repository contactandrewchl-wq/turtle-mcp (2 stars, last pushed 2mo ago), licensed MIT. It adds 57 tokens to every session and 1,139 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gno
Search local documents, files, notes, and knowledge bases. Index directories, search with BM25/vector/hybrid, get AI answers with citations. Use when user wants to search files, find documents, query notes, look up information in local folders, index a directory, set up document search, build a knowledge base, needs…
knowledge-engineering-quality-and-delivery-build-release-and-documentation
A delivery system for building, testing, versioning, publishing, and documenting a TypeScript monorepo, which is one repository containing multiple related packages.
knowledge-engineering-quality-and-delivery
A project-wide quality and delivery workflow covering tests, release checks, builds, publishing, and bilingual documentation for Blade Code.
verify
Pre-merge verification gate. Build, test, and lint must all pass before marking done or shipping.
audit-harness
Use when auditing HARNESS.md, pre-commit hooks, pre-push hooks, architecture gates, or CI workflows for tunacode-cli. This skill treats any mismatch, skipped gate, or failing check as a critical failure and requires manual one-by-one execution rather than make targets, batch wrappers, or summary-only audits.
engram-memory
Give the agent durable, local memory with engram — recall past decisions before answering, and persist new decisions, preferences and facts as they happen. Use when work spans sessions or the user says "remember".