Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add irahardianto/awesome-agv --skill supply-chain-securitygit clone --depth 1 https://github.com/irahardianto/awesome-agvWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/irahardianto/awesome-agv/supply-chain-security)<a href="https://agentmods.dev/skills/irahardianto/awesome-agv/supply-chain-security"><img src="https://agentmods.dev/badge/skills/irahardianto/awesome-agv/supply-chain-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/irahardianto/awesome-agv/supply-chain-security"><img src="https://agentmods.dev/badge/skills/irahardianto/awesome-agv/supply-chain-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 47 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.00682 |
| Opus 5.5 | $0.00012 | $0.00273 |
| Sonnet 5.5 | $0.00006 | $0.00136 |
| Haiku 4.5 | $0.00003 | $0.00068 |
Grade A, and why
supply-chain-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- supply-chain-security — 95% identical, 6 lines differ
How it starts
The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Supply Chain Security Principles
Guidelines for securing the software supply chain.
When to Invoke
- Auditing project dependencies
- Setting up CVE scanning in CI/CD
- License compliance review
- Responding to supply chain vulnerability disclosures
Dependency Security
CVE Scanning
| Language | Tool | Command |
|---|---|---|
| Go | govulncheck |
govulncheck ./... |
| Rust | cargo audit |
cargo audit |
| Python | pip-audit |
pip-audit |
| Node.js | npm audit |
npm audit |
| Java | OWASP Dependency-Check | mvn dependency-check:check |
| .NET | Built-in | dotnet list package --vulnerable |
| Ruby | bundle audit |
bundle audit check --update |
| PHP | composer audit |
composer audit |
Scanning Frequency
- Every CI run — fail build on critical/high CVEs
- Weekly scheduled scan — catch newly disclosed vulnerabilities
- On dependency update — verify new version is clean
SBOM (Software Bill of Materials)
Generation
# CycloneDX format (recommended)
# Go
cyclonedx-gomod mod -json -output sbom.json
# Node.js
npx @cyclonedx/cyclonedx-npm --output-file sbom.json
# Python
cyclonedx-py poetry --format json -o sbom.json
Usage
- Attach SBOM to releases
- Track all transitive dependencies
- Enable downstream vulnerability analysis
License Compliance
Risk Levels
| License | Risk | Action |
|---|---|---|
| MIT, BSD, Apache 2.0 | Low | Permissive — generally safe |
| LGPL | Medium | Review linking requirements |
| GPL | High | Copyleft — may require source disclosure |
| AGPL | Critical | Network copyleft — consult legal |
| No license | Critical | Cannot use — no rights granted |
Automation
- Use
license-checker(Node.js),pip-licenses(Python),cargo-license(Rust) - Maintain allowlist/denylist of approved licenses
- Fail CI on disallowed licenses
Supply Chain Attack Prevention
- Lock files committed —
package-lock.json,go.sum,Cargo.lock,poetry.lock - Pin exact versions in production — no floating ranges
- Verify checksums — lock files contain integrity hashes
- Review new dependencies — check maintainer, downloads, last commit, open issues
- Minimal dependencies — each dep = increased attack surface
- Signed commits and releases — verify artifact provenance
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 87 lines · 29 tokens per session scan A c370c6d21420
supply-chain-security is a skill published in the GitHub repository irahardianto/awesome-agv (156 stars, last pushed 13d ago), licensed MIT. It adds 29 tokens to every session and 682 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
om-setup-ci
Set up or refresh CI for a standalone Open Mercato app in one command — GitHub Actions with dependency audit, secret scan (Gitleaks), SAST (Semgrep with Open Mercato rules), workflow security (zizmor), lint, generate + clean-tree check, typecheck, design-system check, unit tests, build, ephemeral integration tests…
dart-tooling
Dart static analysis, linting, formatting, and code-generation standards. Use only for analysisoptions.yaml, buildrunner, dart format, DCM, lefthook, or analyze/format CI failures; defer Dart language, null-safety, Flutter tests, and generic CI questions.
flutter-cicd
Set up CI/CD pipelines for Flutter apps. Use when configuring automated testing, build, or deployment workflows with GitHub Actions or Fastlane.
android-tooling
Configure Android static analysis with Detekt, Ktlint, and Android Lint for CI/CD quality gates. Use for Android-specific lint and quality tooling; defer generic Java Checkstyle, SonarQube, and standalone CI configuration.
land-and-deploy
Merge PR, wait for CI, verify deploy, run canary. The complete landing pipeline.
ci-all
Full CI pipeline: run local tests, type check, push branch, and return the pipeline URL. The only command you need before opening a PR.