Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add personamanagmentlayer/pcl --skill supply-chain-security-expertgit clone --depth 1 https://github.com/personamanagmentlayer/pclWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/personamanagmentlayer/pcl/supply-chain-security-expert)<a href="https://agentmods.dev/skills/personamanagmentlayer/pcl/supply-chain-security-expert"><img src="https://agentmods.dev/badge/skills/personamanagmentlayer/pcl/supply-chain-security-expert/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/personamanagmentlayer/pcl/supply-chain-security-expert"><img src="https://agentmods.dev/badge/skills/personamanagmentlayer/pcl/supply-chain-security-expert.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 130 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 140 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium MCP Rug Pull · line 123 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 124 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- low Tool Misuse · line 124 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.02909 |
| Opus 5 | $0.00051 | $0.01455 |
| Sonnet 5 | $0.00020 | $0.00582 |
| Haiku 4.5 | $0.00010 | $0.00291 |
Grade A, and why
supply-chain-security-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 339 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Supply Chain Security Expert
Most of what ships is code nobody on the team wrote. OWASP ranks software supply chain failures among the highest-impact categories in the 2025 Top 10, and EU regulation (NIS2, and the Cyber Resilience Act) now makes dependency management a compliance obligation rather than an engineering preference.
Core Concepts
The Attack Surface
| Vector | Example | Primary control |
|---|---|---|
| Malicious package | Typosquat, or a maintainer account takeover | Pinning, provenance, install-script review |
| Compromised dependency | Legitimate package backdoored in a release | SBOM plus continuous scanning |
| Dependency confusion | Internal package name resolved from a public registry | Scoped registries, explicit source pinning |
| Build system compromise | CI injects code into the artefact | Hermetic builds, provenance attestation |
| Artefact tampering | Registry image replaced after publication | Signing, digest pinning, admission policy |
| Credential theft in CI | A leaked token publishes a malicious release | OIDC federation, least-privilege tokens |
Know What You Ship
You cannot patch what you cannot enumerate. An SBOM is the inventory — generated at build time from what actually went in, not written by hand.
Provenance Is Stronger Than Scanning
Scanning tells you about known vulnerabilities. Provenance tells you that this artefact was built from this commit by that pipeline. When a new advisory lands, scanning finds it; when a build system is compromised, only provenance does.
SBOM
Generate at build time, store as a build artefact, attach to the release.
# From a container image, a filesystem, or a lockfile
syft packages ghcr.io/acme/api:1.4.2 -o cyclonedx-json > sbom.cdx.json
syft packages dir:. -o spdx-json > sbom.spdx.json
# Scan the SBOM rather than re-resolving dependencies
grype sbom:sbom.cdx.json --fail-on high
osv-scanner --sbom sbom.cdx.json
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 339 lines · 102 tokens per session scan A e86a9ca788e2
supply-chain-security-expert is a skill published in the GitHub repository personamanagmentlayer/pcl (40 stars, last pushed 2d ago), licensed Apache-2.0. It adds 102 tokens to every session and 2,909 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
Supply Chain Security
Software supply chain security — SBOM generation and analysis, dependency confusion and typosquatting detection, malicious package indicators, CI/CD pipeline hardening, and artifact provenance/signing (SLSA, Sigstore).
implementing-supply-chain-security-with-in-toto
Implement software supply chain integrity verification for container builds using the in-toto framework to create cryptographically signed attestations across CI/CD pipeline steps.
implementing-image-provenance-verification-with-cosign
Sign and verify container image provenance using Sigstore Cosign with keyless OIDC-based signing, attestations, and Kubernetes admission enforcement.
verifying-build-provenance-with-slsa-sigstore
Verify signed artifacts and SLSA build provenance with Sigstore cosign and slsa-verifier, enforce keyless OIDC identity, and apply SLSA Build levels to harden the software supply chain.
sbom-syft
Software Bill of Materials (SBOM) generation using Syft for container images, filesystems, and archives. Detects packages across 28+ ecosystems with multi-format output support (CycloneDX, SPDX, syft-json). Enables vulnerability assessment, license compliance, and supply chain security. Use when: (1) Generating SBOMs…
sca-blackduck
Software Composition Analysis (SCA) using Synopsys Black Duck for identifying open source vulnerabilities, license compliance risks, and supply chain security threats with CVE, CWE, and OWASP framework mapping. Use when: (1) Scanning dependencies for known vulnerabilities and security risks, (2) Analyzing open source…