Supply Chain Security

Use this skill when dependencies, lockfiles, build/release scripts, CI, or third-party tools change.

Workflow

1. Inspect changed dependency and build files.
2. Prefer lockfile-preserving installs and deterministic package managers.
3. Run available scanners:
   • gitleaks detect --source . --no-git
   • osv-scanner . when installed
   • language-specific audit commands when the project provides them
4. Check package provenance and maintainer risk for new critical dependencies.
5. Document SBOM/provenance expectations in docs/harness/SUPPLY_CHAIN.md.
6. Document unresolved vulnerabilities or accepted risk in docs/harness/RISKS.md.
7. Update docs/harness/RELEASE_PLAN.md when release artifacts or build integrity changes.

Review Points