Skill supply chain audit
Skill charlieviettq/awesome-agent-skill/.claude/skills/skill-supply-chain-audit
Curated skill pack for LLM agents in engineer and science workflow (Cursor & Claude ready).
npx -y skills add charlieviettq/awesome-agent-skill --skill skill-supply-chain-auditAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 22 stars22 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Audit third-party agent skills before install—metadata, triggers, scripts, network/exfil patterns, and overlap with existing skills. Use before importing skills from external catalogs or vendoring new SKILL.md files.
SKILL.md
1.6 KB, as published. Nobody here has run it
Skill supply chain audit
When to run
- Before adding skills from Antigravity, skills.sh, or unknown repos.
- After updating vendored skill packs.
- When a skill requests unusual permissions or runs shell scripts.
Audit checklist
| Check | Pass criteria |
|---|---|
| Source | Known repo, license noted, pinned version or commit |
| Frontmatter | name matches folder; description matches behavior |
| Triggers | No overly broad auto-invoke (e.g. every message) |
| Scripts | No obfuscated code; no blind curl | bash |
| Network | No hidden exfil endpoints; env secrets not required unless justified |
| Overlap | Not duplicate of gstack/voltagent/local skill |
| Risk tier | Document if offensive security or prod-destructive |
Risk tiers
- Low: Markdown-only workflow guidance.
- Medium: Runs project test/lint commands; reads repo files.
- High: Network calls, credential use, prod mutations, pen-test payloads.
High-risk skills: opt-in only; do not add to default installed_skills until reviewed.
Decision
| Outcome | Action |
|---|---|
| Adopt | Copy/adapt to local style; register in skill-config |
| Adapt | Extract pattern; shorten; remove unsafe steps |
| Reject | Do not install; note reason |
Output
Short audit note: source, risk tier, overlap, adopt/adapt/reject, required mitigations.