agentsclimarketplace

Supply chain audit

Skill HetCreep/CoalMine/skills/supply-chain-audit

Nine quality-canary skills for AI coding agents - code health, world-class rule completeness, grounding, supply chain, resilience, drift & more - plus the auto-cadence hooks that run them unprompted at session start and session end. Cross-agent, consent-gated, token-lean.

Install
npx -y skills add HetCreep/CoalMine --skill supply-chain-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 11 stars11 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Software supply chain audit — dependencies (CVEs, maintenance, licenses, transitive risk), build/CI integrity (SHA-pinned actions, lockfile, CI-only release), artifact integrity (checksums, signing, SBOM). Triggers on: "/supply-chain-audit", "supply-chain-audit", "dependency audit". Run before adding a dep, before a release, or for periodic review. Reports; does not change deps unless asked.

SKILL.md

2.6 KB, as published. Nobody here has run it

Supply-Chain Audit

<!-- SHARED:LANGUAGE_HEADER -->

Audit what the project trusts: deps, build pipeline, shipped artifact. Report; do NOT change deps unless asked.

1. Dependencies

  • Scope — honor .coalmine.json packageManifests if set: scan exactly those manifest/lockfile paths; else infer by inspecting the repo.
  • CVEs — run ecosystem auditor; cross-check every hit in GHSA/OSV/NVD. Cite advisory ID + affected range + fixed version. (Invoke source-grounding — never from memory.)
  • Maintenance — last release, commit recency, bus-factor, archived/deprecated flag.
  • License — flag copyleft inside permissive project, missing/unknown license.
  • Transitive — full tree; name the parent to bump for a transitive fix.
  • Behavior — phone home? install scripts? unexpected egress?

2. Build / CI

  • CI-only release builds?
  • Actions pinned to commit SHA (not floating tag)?
  • Lockfile committed + enforced in CI?
  • Minimal token scope? No pull_request_target?

3. Artifact

  • SHA-256 checksums published for every binary?
  • Signed (Authenticode/GPG)? Gap documented honestly?
  • SBOM generated?
  • User can verify before running?

Tooling

Per-ecosystem vuln/license/outdated commands + offline fallback: read references/tooling.md when selecting scanners.

Discipline

  • Ground every CVE/fixed-version in an advisory. Never from memory.
  • Don't auto-change deps — report + recommend; user decides (bumps break builds).
  • State what was NOT scanned. Blocked network scans → lockfile inspection fallback (see references/tooling.md), mark live checks N-A.

Fix mode (choice-gated)

After the report, present via ask_question:

  • Pin safe now — commit already-present unchanged lockfile, pin CI action to current SHA, add missing checksum step. Each: checkpoint → apply → verify.
  • Let me pick — user-selected fixes only.
  • Report only — change nothing.

NEVER auto-fix: dep version bump, lockfile regen (re-resolves entire transitive tree).

Output

| package | direct/transitive | issue | severity | advisory | fixed-in | action | Build+artifact checklist · Summary (counts + top fixes) · Not scanned

<!-- SHARED:ORCHESTRATION --> <!-- SHARED:ESCALATION_FOOTER -->

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.