Ai supply chain security
Skill sebastienrousseau/agtmls/skills/ai-supply-chain-security
Use when auditing AI-agent supply chain risk, prompt or skill provenance, dependency trust, SBOM/SLSA evidence, MCP tool-poisoning, package provenance, or agent runtime guardrails before release.From its SKILL.md
npx -y skills add sebastienrousseau/agtmls --skill ai-supply-chain-securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its file declares
Copied from the file, not written here
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
1.5 KB, as published. Nobody here has run it
AI Supply Chain Security
Use this skill to audit agentic supply-chain risk before shipping an AI-enabled repository or skill pack.
Workflow
- Identify generated artifacts, skills, prompts, tools, MCP servers, and provider adapters.
- Check provenance: source commit, generator script, checksum, license, and owner.
- Check package risk: dependency confusion, typosquatting, unsigned artifacts, unpinned install commands, and shell-pipe installers.
- Check agent risk: prompt injection, MCP tool poisoning, unreviewed network access, file-write authority, and secret handling.
- Require release evidence:
SBOM.spdx.json,provenance.json,SHA256SUMS, and greenagtmls.py check. - Report blocking issues before publishing or installing globally.
Evidence
Record reviewed files, commands run, and residual risks in the evidence log when available.