supply-chain-attack-response
supply-chain-attack-response is an code AI skill with a core value of Detect, respond to, and prevent software supply chain attacks on package registries, container images, and CI/CD pipelines with lockfile auditing, provenance verification. It
helps developers solve real-world problems in the code domain, boosting
efficiency, automating repetitive tasks, and optimizing workflows.
Detect, respond to, and prevent software supply chain attacks on package registries, container images, and CI/CD pipelines with lockfile auditing, provenance verification
Quick Facts
mkdir -p ./skills/supply-chain-attack-response && curl -sfL https://raw.githubusercontent.com/sickn33/antigravity-awesome-skills/main/skills/supply-chain-attack-response/SKILL.md -o ./skills/supply-chain-attack-response/SKILL.mdRun in terminal / PowerShell. Requires curl (Unix) or PowerShell 5+ (Windows).
Skill Content
> **⚠️ AUTHORIZED USE ONLY**
> This skill is for educational purposes or authorized security assessments only.
> You must have explicit, written permission from the system owner before using this tool.
> Misuse of this tool is illegal and strictly prohibited.
> **Mandatory confirmation gate**
> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
> 1. Ask the user to state the exact target URL, IP, account, or resource.
> 2. Ask the user to confirm written authorization and the permitted scope.
> 3. Show the exact command(s) and explain their expected effect.
> 4. Wait for explicit confirmation in the current conversation.
>
> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
# Supply Chain Attack Response
Software supply chain attacks target the dependencies, build systems, and distribution channels that developers trust implicitly. When a package on PyPI, npm, or crates.io is compromised, every downstream consumer inherits the malicious payload. This skill provides detection techniques, emergency response playbooks, and hardening strategies to protect your software supply chain end to end.
---
2. Detection
2.1 npm Audit
# Full audit of installed packages
npm audit
# JSON output for programmatic processing
npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.severity == "critical")'
# Fix automatically where possible
npm audit fix
# Check for known malicious packages via Socket.dev CLI
npx socket scan --package-lock package-lock.json2.2 pip Audit
# Install pip-audit (maintained by Google/OSSF)
pip install pip-audit
# Audit current environment against OSV.dev
pip-audit
# Audit a requirements file directly
pip-audit -r requirements.txt --output json
# Check for typosquatting with bandersnatch or custom script
pip-audit --strict --desc on2.3 Cargo Audit
# Install cargo-audit
cargo install cargo-audit
# Run audit against RustSec Advisory Database
cargo audit
# JSON output for CI integration
cargo audit --json
# Check for yanked crates
cargo audit --deny yanked2.4 Sigstore / Cosign Verification
# Verify a container image signature with cosign
cosign verify \
--certificate-identity "https://github.com/myorg/myrepo/.github/workflows/build.yml@refs/heads/main" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
ghcr.io/myorg/myimage:latest
# Verify an artifact with sigstore-python
pip install sigstore
python -m sigstore verify identity \
--cert-identity "release@example.com" \
--cert-oidc-issuer "https://accounts.google.com" \
artifact.tar.gz2.5 SLSA Provenance Checks
# Install slsa-verifier
go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@latest
# Verify provenance of a binary
slsa-verifier verify-artifact my-binary \
--provenance-path my-binary.intoto.jsonl \
--source-uri github.com/myorg/myrepo \
--source-tag v1.2.3---
3. Emergency Response Playbook
When a dependency is confirmed compromised, execute these steps in order.
Step 1: Contain -- Pin and Freeze
# Pin the last known-good version immediately in package.json
npm install <package>@<safe-version> --save-exact
# For pip, pin with hash verification
pip download <package>==<safe-version> --require-hashes -d ./vendor/
# For cargo, pin in Cargo.toml
# Replace: some_crate = "^1.2" with:
# some_crate = "=1.2.3"
cargo update -p some_crate --precise 1.2.3Step 2: Audit Exposure
# Determine which versions you pulled and when
# npm
npm ls <compromised-package>
cat package-lock.json | jq '.packages | to_entries[] | select(.key | contains("<compromised-package>"))'
# pip
pip show <compromised-package>
pip cache list <compromised-package>
# Check git history for when the dependency versi🎯 Best For
- Claude users
- Software engineers
- Development teams
- Tech leads
💡 Use Cases
- Code quality improvement
- Best practice enforcement
📖 How to Use This Skill
- 1
Install the Skill
Copy the install command from the Terminal tab and run it. The SKILL.md file downloads to your local skills directory.
- 2
Load into Your AI Assistant
Open Claude and reference the skill. Paste the SKILL.md content or use the system prompt tab.
- 3
Apply supply-chain-attack-response to Your Work
Open your project in the AI assistant and ask it to apply the skill. Start with a small module to verify the output quality.
- 4
Review and Refine
Review AI suggestions before committing. Run tests, check for regressions, and iterate on the skill output.
❓ Frequently Asked Questions
Is supply-chain-attack-response compatible with Cursor and VS Code?
Yes — this skill works with any AI coding assistant including Cursor, VS Code with Copilot, and JetBrains IDEs.
Do I need specific dependencies for supply-chain-attack-response?
Check the install command and Works With section. Most code skills only require the AI assistant and your codebase.
How do I install supply-chain-attack-response?
Copy the install command from the Terminal tab and run it. The skill downloads to ./skills/supply-chain-attack-response/SKILL.md, ready to use.
Can I customize this skill for my team?
Absolutely. Edit the SKILL.md file to add team-specific instructions, examples, or workflows.
⚠️ Common Mistakes to Avoid
Skipping validation
Always test AI-generated code changes, even for simple refactors.
Missing dependency updates
Check if the skill requires updated dependencies or new packages.