More screenshots

    Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+20 more

    📦 Package Supply-Chain Sentinel

    1

    Review local dependency manifests for lifecycle-script, source-URL, download-command and version-management clues before installation.

    $19

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    0 installsSecurity scanned
    📦 Package Supply-Chain Sentinel

    📦 Package Supply-Chain Sentinel

    Example session with this skill installed

    Explain how to review the included risky-sample fixture before scanning a real dependency snapshot. Do not install packages or claim a dependency is safe.

    • Read your context and instructions
    • Compiled the package supply-chain sentinel

    Fixture-first review guide

    This is an illustrative workflow explanation, not a captured scan or an assessment of a real dependency.

    1. Extract the complete folder and read SKILL.md. Keep scripts, references and fixtures together.
    2. Use Python 3.10+ to run the scanner against the included risky-sample fixture before providing your own files.
    3. Inspect text-pattern clues for lifecycle-script mentions, non-registry sources, download commands and version-management terms. A match does not establish malicious intent.
    4. Use the supplied checklist for manual package-name, reputation and lockfile-change review. Do not invent download counts or hash-verification results.
    5. Provide only a stable non-secret snapshot. Review output before sharing; filenames may be sensitive.

    Result states: REVIEW means inspect findings. CANNOT_ASSESS means coverage is incomplete. NO_HEURISTIC_FINDINGS is not a safety guarantee.

    Boundary: No package installation, hook execution, registry-hash authentication or Git provenance verification.

    1. Extract the complete folder and read SKILL.md

    Connects securely to your tools. The creator never sees your data.

    What you get

    Use a checklist for manual package-name and reputation evidence reviewFlag lifecycle-script mentions as review clues, without running hooksReview source references and lockfile changes without claiming registry-hash authenticationInspect download-command and version-management matches before installation

    About this skill

    Review dependency clues before installation

    Package Supply-Chain Sentinel combines a local Python text-pattern scanner with checklists for manual package-name, reputation and lockfile-change review. Automated findings are review clues, not confirmed malicious behavior.

    What you get

    A downloadable SKILL.md package, Python scanner, references, fixtures and tests. Four rules check lifecycle-script mentions, non-registry source references, download commands, and floating-version or package-management clues. It is not a hosted app or a vulnerability database.

    Requirements and version

    Package v1.1.0 requires Python 3.10+ using its standard library. Extract the complete folder and use a local terminal or an agent with local Python execution. Start with the included fixture. An AI-agent subscription or setup service is not included.

    Reports and limits

    Reports omit source excerpts and matched values. Missing, unreadable or incomplete inputs return CANNOT_ASSESS. Files over 5 MiB are not scanned. Additional matches beyond 500 findings stop scanning with a finding_limit notice. Use only stable, reviewed non-secret snapshots. Filenames can still be sensitive; inspect reports before sharing. This is not a race-resistant sandbox or a total runtime guarantee.

    Separate manual review

    Package-name/typosquatting and lockfile-change checks require manual evidence review. The scanner does not authenticate registry hashes, verify Git provenance, query CVE or reputation services, install packages, execute lifecycle hooks or prove a dependency safe. Absence of findings is not proof of safety or complete coverage.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 13 days ago

    • Passed all security checks, Safe to install

    Listed3 months ago
    Updated13 days ago

    What's inside

    Frequently Asked Questions