aegis-supply-chain

Scope & Objectives

• Inventory every dependency manifest/lockfile pair across all ecosystems present in the repo (npm/yarn/pnpm, pip/Pipfile/poetry/uv, Go modules, Maven/Gradle, NuGet, Composer, Bundler, Cargo).
• Assess version risk statically: EOL runtimes/majors, packages whose bad reputation you are certain of; defer everything else to network-gated official scanners listed here.
• Test lockfile hygiene: missing lockfiles, manifest/lockfile drift, vendored trees without provenance, git submodules floating on a branch instead of a commit.
• Map the typosquat/install-script surface: lifecycle scripts in dependency package.json files, dependencies that do not belong, dependency-confusion preconditions (missing private-registry scoping).
• Judge pinning posture: semver ranges without locks, Dockerfile FROM :latest, unpinned GitHub Actions refs, curl | bash in images and CI.
• Audit CI/CD pipeline logic: pull_request_target secret exposure to forks, ${{ github.event.* }} interpolation into run: blocks (script injection), third-party actions without SHA pinning, self-hosted runners attached to public-repo workflows, artifact tampering paths, deploy-credential breadth, cache poisoning preconditions.
• Check build integrity: SBOM generation absent, artifacts unsigned, stale base images, unpinned package installs inside images.
• Objectives: produce findings with file:line evidence, classify via the severity rubric, mark every uncertain item Needs-Review, and clearly separate offline-static conclusions from conclusions that require the network-gated scanners.

Out of scope: runtime container escape, secrets storage hygiene itself (cross-reference skills/code/secrets-data-exposure/SKILL.md for leaked credentials, including creds echoed into CI logs), and application-level injection sinks (skills/code/injection/SKILL.md covers reachable sinks used by the severity rubric below).

Prerequisites & Vocabulary

Zero-background primer: the terms this module uses, one line each. Deeper plain-language explanations for every class live in the repository GUIDE.md glossary.