skill-supply-chain-audit
Installation
SKILL.md
Skill supply chain audit
When to run
- Before adding skills from Antigravity, skills.sh, or unknown repos.
- After updating vendored skill packs.
- When a skill requests unusual permissions or runs shell scripts.
Audit checklist
| Check | Pass criteria |
|---|---|
| Source | Known repo, license noted, pinned version or commit |
| Frontmatter | name matches folder; description matches behavior |
| Triggers | No overly broad auto-invoke (e.g. every message) |
| Scripts | No obfuscated code; no blind curl | bash |
| Network | No hidden exfil endpoints; env secrets not required unless justified |
| Overlap | Not duplicate of gstack/voltagent/local skill |
| Risk tier | Document if offensive security or prod-destructive |