What is supply-chain-audit?

A checklist for examining the contents and origins of agent add-ons and their dependencies before adoption. It covers source provenance, versions, licenses, network access, and permissions.

Use it to audit skills, plugins, MCP servers, packages, hooks, scripts, and remote prompts for supply-chain risks.

It helps identify untrusted code, changing upstream sources, risky access, and unclear licensing before they enter a project.

supply-chain-audit — Skill for Claude Code by ulises-jeremias

Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo

git clone --depth 1 https://github.com/ulises-jeremias/agent-toolkit

agentmods

npx agentmods add skills/ulises-jeremias/agent-toolkit/supply-chain-audit

Made for: Claude Code.

Or install agent-toolkit-complete, the plugin that ships this one along with the rest of its 106 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/ulises-jeremias/agent-toolkit/supply-chain-audit/github.svg)](https://agentmods.dev/skills/ulises-jeremias/agent-toolkit/supply-chain-audit)

Your own site

<a href="https://agentmods.dev/skills/ulises-jeremias/agent-toolkit/supply-chain-audit"><img src="https://agentmods.dev/badge/skills/ulises-jeremias/agent-toolkit/supply-chain-audit/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/ulises-jeremias/agent-toolkit/supply-chain-audit"><img src="https://agentmods.dev/badge/skills/ulises-jeremias/agent-toolkit/supply-chain-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 44 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,397 The whole file, excluding the scripts and references it only reads on demand.

Security scan C 3 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00044	$0.01397
Opus 5.5	$0.00018	$0.00559
Sonnet 5.5	$0.00009	$0.00279
Haiku 4.5	$0.00004	$0.00140

Measured 1mo ago against content hash fba4830eb1fc, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

supply-chain-audit scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codemediumSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

- Hooks: `command` array, no `curl | bash`, no `npx` without pin

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Recursive force deletemediumDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

filesystem: writes outside workspace, destructive mv/rm -rf

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- Hooks: `command` array, no `curl | bash`, no `npx` without pin

plugins/agent-toolkit-complete/.github/skills/supply-chain-audit/SKILL.md · 143 lines

How it starts

The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Supply-Chain Audit

Inspect a capability's supply chain before adopting — validate provenance, pins, hashes, licenses, network, and permissions.

Use when

Reviewing a PR that vendors a new third-party skill/plugin/MCP
Deciding ADOPT vs PIN EXTERNALLY vs REJECT for an upstream
Auditing existing skills/, mcp/registry/, plugins/, hooks, or npm/py deps

Inputs

Capability path (e.g., skills/design/frontend-design/, mcp/registry/github.yaml, plugins/agent-toolkit-core/.claude-plugin/plugin.json)
Optional: capabilities/upstream.lock or SKILL.md frontmatter upstream block

Steps

1. Provenance

Check upstream: {repository, path, ref, license}:

ref must be immutable tag or 40-char SHA — never main/master/latest
license must be SPDX or unknown (if unknown → prefer PIN EXTERNALLY, document why)
Compare ref to upstream latest (gh api repos/<owner>/<repo>/commits or git ls-remote) — flag drift
For vendored content, verify LICENSE.txt/NOTICE preserved alongside

Host users: apply the checks above by reading SKILL.md frontmatter and capabilities/upstream.lock (when present). Do not rely on repo-root scripts/ — those paths are not installed with the toolkit.

Maintainer / repo checkout / CI only:

python3 scripts/validate-upstream.py --check
python3 scripts/validate-upstream.py --strict  # flags missing provenance for third-party-looking paths

2. Version pins & hashes

MCP: mcp/registry/*.yaml package must be pinned (tag/SHA), not latest
npm/py: package.json/pyproject.toml pins, no unpinned *
Docker (MegaLinter): image sha256: pinned
Hooks: command array, no curl | bash, no npx without pin
Check for capabilities/upstream.lock or embedded checksum (per #370) if available

3. Licenses & redistribution

Verify upstream.license matches repo LICENSE (check gh api repos/<owner>/<repo>/license and per-subdir LICENSE if ambiguous — e.g., nextlevelbuilder/ui-ux-pro-max-skill gallery/cli)
If AGPL (e.g., oxsecurity/megalinter) → prefer PIN EXTERNALLY, not vendored (avoid MIT contagion)
Document distribution.redistribution_allowed and attribution_file

Read the full file on GitHub · 143 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 143 lines · 44 tokens per session scan C fba4830eb1fc

Subscribe to this mod's changes

supply-chain-audit is a skill published in the GitHub repository ulises-jeremias/agent-toolkit (19 stars, last pushed yesterday), licensed MIT. It adds 44 tokens to every session and 1,397 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it C with 3 findings (downloads and executes remote code, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.

Claude Code Security agent-toolkit ai-agents ai-tools cursor github-copilot

verify

Fact-check claims encountered during reading — dates, names, events, citations. Use when encountering historical facts or disputed claims.

yha9806/academic-writing-toolkit · 26 tokens

skillnote

Self-hosted skill registry for OpenClaw. Stores procedures your team writes (name, description, body), syncs them to disk before each task, and collects which-helped/which-failed signals from the agent so the registry improves over time.

luna-prompts/skillnote · 54 tokens

pr-alignment-loop

Iterate a PR to its final form by running two opposing reviewer droids (reviewer-robustness and reviewer-minimalist) in a bounded back-and-forth loop. The main orchestrator synthesizes their feedback, makes edits, runs tests, and stops when both approve, on stagnation, or after 3 rounds. Use when the user asks to…

nikships/skills-registry · 122 tokens

publish-website

Publish a website to Porkbun Secure Static Hosting. Use when the user asks you to build, create, update or put live a website, landing page or placeholder page for a domain they have at Porkbun, mentions Porkbun hosting or static hosting, or asks how to upload site files to Porkbun.

oborseth/Porkbun-MCP · 65 tokens

create-rule

Use when creating, writing, or updating a Claude Code rule file (.claude/rules/.md or /.claude/rules/.md), or when asking about rule format, path scoping, or rule best practices.

paultyng/skill-issue · 48 tokens

platform-setup

Set up, verify, and troubleshoot Katalon True Platform/TestOps MCP connectivity for any AI coding agent. Use when you need to install or configure the Katalon MCP server, connect to a Katalon platform account, verify available Katalon MCP tools, diagnose missing authentication or repository access, confirm…

katalon-labs/true-skills · 110 tokens

supply-chain-audit