Borrowing it
Nothing to install: this file belongs to irahardianto/rugged-gemini. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/irahardianto/rugged-gemini/main/.gemini/skills/supply-chain-security/SKILL.mdgit clone --depth 1 https://github.com/irahardianto/rugged-geminiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/irahardianto/rugged-gemini/supply-chain-security)<a href="https://agentmods.dev/skills/irahardianto/rugged-gemini/supply-chain-security"><img src="https://agentmods.dev/badge/skills/irahardianto/rugged-gemini/supply-chain-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/irahardianto/rugged-gemini/supply-chain-security"><img src="https://agentmods.dev/badge/skills/irahardianto/rugged-gemini/supply-chain-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.00681 |
| Opus 5.5 | $0.00012 | $0.00272 |
| Sonnet 5.5 | $0.00006 | $0.00136 |
| Haiku 4.5 | $0.00003 | $0.00068 |
Grade A, and why
supply-chain-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
95% identical to supply-chain-security — 6 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Supply Chain Security Principles
Guidelines for securing the software supply chain.
When to Invoke
- Auditing project dependencies
- Setting up CVE scanning in CI/CD
- License compliance review
- Responding to supply chain vulnerability disclosures
Dependency Security
CVE Scanning
| Language | Tool | Command |
|---|---|---|
| Go | govulncheck |
govulncheck ./... |
| Rust | cargo audit |
cargo audit |
| Python | pip-audit |
pip-audit |
| Node.js | npm audit |
npm audit |
| Java | OWASP Dependency-Check | mvn dependency-check:check |
| .NET | Built-in | dotnet list package --vulnerable |
| Ruby | bundle audit |
bundle audit check --update |
| PHP | composer audit |
composer audit |
Scanning Frequency
- Every CI run — fail build on critical/high CVEs
- Weekly scheduled scan — catch newly disclosed vulnerabilities
- On dependency update — verify new version is clean
SBOM (Software Bill of Materials)
Generation
# CycloneDX format (recommended)
# Go
cyclonedx-gomod mod -json -output sbom.json
# Node.js
npx @cyclonedx/cyclonedx-npm --output-file sbom.json
# Python
cyclonedx-py poetry --format json -o sbom.json
Usage
- Attach SBOM to releases
- Track all transitive dependencies
- Enable downstream vulnerability analysis
License Compliance
Risk Levels
| License | Risk | Action |
|---|---|---|
| MIT, BSD, Apache 2.0 | Low | Permissive — generally safe |
| LGPL | Medium | Review linking requirements |
| GPL | High | Copyleft — may require source disclosure |
| AGPL | Critical | Network copyleft — consult legal |
| No license | Critical | Cannot use — no rights granted |
Automation
- Use
license-checker(Node.js),pip-licenses(Python),cargo-license(Rust) - Maintain allowlist/denylist of approved licenses
- Fail CI on disallowed licenses
Supply Chain Attack Prevention
- Lock files committed —
package-lock.json,go.sum,Cargo.lock,poetry.lock - Pin exact versions in production — no floating ranges
- Verify checksums — lock files contain integrity hashes
- Review new dependencies — check maintainer, downloads, last commit, open issues
- Minimal dependencies — each dep = increased attack surface
- Signed commits and releases — verify artifact provenance
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 87 lines · 29 tokens per session scan A 5a9dd3b65e76
supply-chain-security is a skill published in the GitHub repository irahardianto/rugged-gemini (5 stars, last pushed 5mo ago), licensed MIT. It adds 29 tokens to every session and 681 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 95% identical to supply-chain-security, differing in 6 lines, and is treated as a copy.
Other skills, from other repositories
chinese-git-workflow
A reference for configuring Git with Chinese code-hosting services such as Gitee, Coding.net, GitLab China, and CNB, including SSH, HTTPS, credentials, CI, and repository mirroring.
atmos-profiles
Atmos profiles: profile directories, --profile and ATMOSPROFILE activation, profile merge behavior, environment switching, and routing profile-specific auth/toolchain/config overrides.
webhook-management
Configure and validate CCAM webhook targets across supported chat, incident, automation, and generic providers. Use when listing provider requirements, creating or updating a target, scoping it to alert rules, sending a test notification, reviewing delivery history, or deleting a target.
monorepo-management
Master monorepo management with Turborepo, Nx, and pnpm workspaces to build efficient, scalable multi-package repositories with optimized builds and dependency management. Use when setting up monorepos, optimizing builds, or managing shared dependencies.
managing-github-actions-secrets
Creates and updates GitHub Actions secrets for PostHog workflows. Use when adding a new CI secret, rotating an existing secret, wiring a workflow to an API token, package registry credential, deploy key, or any value referenced via ${{ secrets. }} in .github/workflows/.
deployment-engineer
Expert deployment engineer specializing in modern CI/CD pipelines, GitOps workflows, and advanced deployment automation. Masters GitHub Actions, ArgoCD/Flux, progressive delivery, container security, and platform engineering. Handles zero-downtime deployments, security scanning, and developer experience optimization.…