skilld
All skills
simota avatar

/chain

@35ffd55
by shingo imotasimota/agent-skills85 stars
15

Auditing skill/plugin/MCP supply chains and live package compromise: manifests, hidden injection, IoC scans, persistence-first eradication, and gated credential rotation. Not for app SAST (Sentinel).

Ask your Agent

Use this Skill: https://skilld.dev/gh/simota/agent-skills/chain

This session only. Nothing lands on disk.

referencereference-index.md

≈449 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Chain Reference Index

Every reference/ file chain owns, and the condition that makes it worth reading. chain/SKILL.md keeps only the shared-contract rows and a pointer here.

Read this when you need a reference and the Recipe registry did not already name it, or when scanning what this skill can consult at all.

File Read this when...
reference/intake-checklist.md You are running a new-skill intake audit and need the full per-item procedure
reference/unicode-tag-scan.md You need the codepoint ranges, allowlist policy, and scan command for Unicode Tag / bidi / zero-width
reference/bundled-artifact-review.md You are auditing bundled scripts, binaries, or external resources referenced by SKILL.md
reference/supply-chain-malware-ioc-database.md You need dated campaign hashes, paths, package pins, persistence, C2, or propagation IoCs.
reference/supply-chain-malware-scan-procedures.md You are scanning macOS, Linux, Windows/WSL, containers, CI runners, lockfiles, passive logs, or maintainer publishes.
reference/supply-chain-malware-eradication.md You are producing persistence-first quarantine, verify-clean, credential-rotation, or re-onboarding steps.
reference/supply-chain-malware-handoffs.md You need malware-specific handoff payloads for Triage, Sentinel, Gear, Vigil, or Lore.
reference/autorun-schema.md You are emitting the AUTORUN _STEP_COMPLETE block — Chain-specific Output/Next schema.
_common/BOUNDARIES.md Role boundaries with Sentinel / Gauge / Hone / Gear are ambiguous
_common/OPERATIONAL.md You need journal, activity log, AUTORUN, Nexus, Git, or shared operational defaults

Source: SKILL.md on GitHub

Third-party checks

1 alert13d3 checks · Risk CRITICAL
  • Gen Agent Trust Hub13d

    This skill is a security auditing tool designed to detect and eradicate supply chain malware. It contains examples of malicious code patterns and a database of known malware indicators (IoCs) for research and detection purposes. While the skill possesses broad command execution capabilities and processes untrusted third-party data, these are aligned with its primary purpose and are supported by explicit sandboxing and verification procedures. The findings flagged by scanners are documentation of threats, not the threats themselves.

  • Socket13d

    No alerts

  • Snyk13d

    Risk: LOW · No issues

Provenance

Signed by skilld at 35ffd55. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 days ago.

Activeupdated 2 weeks ago

README badge

README badge for simota/agent-skills/chain