تشغيل أي مهارة في Manus بنقرة واحدة

supply-chain

النجوم٠

التفرعات٠

آخر تحديث٢٩ مايو ٢٠٢٦ في ٠٢:٥١

Audit direct dependencies for takeover / abandonment risk (maintainer count, popularity, CVE history, release cadence, ownership) and promote the risky ones into .kuzushi/findings.json (source "supply-chain"). Complements /threat-intel (which checks CVEs, not dependency trustworthiness). Uses the network — asks first.

التثبيت

التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.

تشغيل في Manus

المصدر

allsmog

allsmog/kuzushi-security-plugin

فتح مستودع GitHub عرض مستودعات المنشئ

تنزيل

تشغيل في Manus

المهن ذات الصلةSOC

استنادا إلى تصنيف SOC المهني

مطوّرو البرمجياتمهن الحاسوب والرياضيات·SOC 15-1252

SKILL.md

readonly

name	supply-chain
description	Audit direct dependencies for takeover / abandonment risk (maintainer count, popularity, CVE history, release cadence, ownership) and promote the risky ones into .kuzushi/findings.json (source "supply-chain"). Complements /threat-intel (which checks CVEs, not dependency trustworthiness). Uses the network — asks first.
context	fork
agent	supply-chain-auditor
user-invocable	false

Supply-chain risk audit

Assess whether this project's direct dependencies are trustworthy to depend on.

Run node "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/supply-chain-prepare.mjs" --target "<repo root>" (optionally --input '{"maxDeps":40}'). If it reports no-deps, tell the user no manifests were found and stop. Read the prep's prepPath.
This step uses the network (registry + repo metadata) — confirm with the user first. For each notable dependency, gather metadata (gh + WebSearch/WebFetch): maintainer count, popularity, release recency, CVE/advisory history, ownership transfers. Assign a riskTier (high/medium/low) with the factors.
Write the { dependencies: [...] } bundle to the prep's draftPath, then run the assembleCommand — it persists .kuzushi/supply-chain.json and promotes high→finding, medium→candidate into .kuzushi/findings.json (source:"supply-chain").
Report the tier breakdown and the high-risk deps (name, deciding factor, the fix).

When NOT to use

To find known CVEs in dependencies — that's /threat-intel; this is takeover/abandonment risk.
Offline — it needs registry/repo metadata.
To scan first-party source — use /threat-hunt, /taint-analysis, /sast.

Rationalizations to Reject

"Popular ⇒ safe." → A popular single-maintainer package with stale releases is a prime takeover target; weigh maintainers + cadence, not stars.
"No CVE ⇒ no risk." → Takeover/abandonment risk is forward-looking; past-CVE absence is irrelevant.
"List every transitive dep." → Stay on direct deps you control; note transitive concerns as nextChecks rather than flooding findings.

المزيد من هذا المستودع

نفس المستودع

deep-hunt

allsmog/kuzushi-security-plugin

Interprocedural, hypothesis-driven hunt — finds the multi-file source→sink bugs that pattern-gating and same-file taint miss. Ranks trace anchors (entry points + dangerous sinks), then the deep-hunter agent walks each flow ACROSS files (forward/backward call-graph CLIs) over multiple rounds, confirming propagation and defeating guards, and promotes confirmed cross-file flows into findings.json with the path stored as evidenceGraph. Token-expensive, budget-bounded. Part of the HUNT phase (run via /sweep --deep, or ask for it); leads flow to /verify (panel).

2026-06-110

deep-scan

allsmog/kuzushi-security-plugin

Whole-file deep reader — finds bugs by READING risk-ranked files in full and reasoning from first principles, not by grepping for known patterns. Catches the long tail (project-specific wrappers, business logic, cross-function flaws) that pattern-gated producers structurally miss. Token-expensive; budget-bounded and risk-ranked. Promotes leads into .kuzushi/findings.json (source "deep-scan").

2026-06-110

taint-analysis

allsmog/kuzushi-security-plugin

IRIS-style source→sink taint hunt. Ranks a typed CWE catalog for the repo, then drives subagents to label dangerous sinks, label sources of user input, run Joern/CodeQL dataflow queries (or same-file linking) to connect them, and triage each flow as finding/candidate/rejected. Promotes verdicts into .kuzushi/findings.json. Benefits from a prebuilt CodeQL DB / Joern CPG but degrades gracefully.

2026-06-110

threat-hunt

allsmog/kuzushi-security-plugin

Adversarial per-threat review (Carlini doctrine). For each threat in .kuzushi/threat-model.json, state attacker capabilities, walk source→sink, attempt to bypass every guard, and assign a verdict with evidence. Promotes findings into .kuzushi/findings.json. Requires /threat-model first.

2026-06-110

partition

allsmog/kuzushi-security-plugin

Split the attack surface into parallel-discovery partitions so fan-out hunters explore different subsystems instead of converging on the same shallow bug. Deterministic grouping of /x-ray entry points by component → .kuzushi/partitions.json, which a hunt coordinator hands to one subagent per partition. Run /x-ray first.

2026-06-100

poc

allsmog/kuzushi-security-plugin

Empirical proof-of-concept for the PoC-ready findings. For each finding /verify marked confirmed-exploitable or inconclusive, synthesize a minimal harness that triggers the bug; a host script then runs it in a sandbox (Docker --network none when present, else a gated local run) and classifies the crash into a proof verdict. Attaches a poc block onto each finding. Requires /verify first.

2026-06-100

name	supply-chain
description	Audit direct dependencies for takeover / abandonment risk (maintainer count, popularity, CVE history, release cadence, ownership) and promote the risky ones into .kuzushi/findings.json (source "supply-chain"). Complements /threat-intel (which checks CVEs, not dependency trustworthiness). Uses the network — asks first.
context	fork
agent	supply-chain-auditor
user-invocable	false

Supply-chain risk audit

Assess whether this project's direct dependencies are trustworthy to depend on.

Run node "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/supply-chain-prepare.mjs" --target "<repo root>" (optionally --input '{"maxDeps":40}'). If it reports no-deps, tell the user no manifests were found and stop. Read the prep's prepPath.
This step uses the network (registry + repo metadata) — confirm with the user first. For each notable dependency, gather metadata (gh + WebSearch/WebFetch): maintainer count, popularity, release recency, CVE/advisory history, ownership transfers. Assign a riskTier (high/medium/low) with the factors.
Write the { dependencies: [...] } bundle to the prep's draftPath, then run the assembleCommand — it persists .kuzushi/supply-chain.json and promotes high→finding, medium→candidate into .kuzushi/findings.json (source:"supply-chain").
Report the tier breakdown and the high-risk deps (name, deciding factor, the fix).

When NOT to use

To find known CVEs in dependencies — that's /threat-intel; this is takeover/abandonment risk.
Offline — it needs registry/repo metadata.
To scan first-party source — use /threat-hunt, /taint-analysis, /sast.

Rationalizations to Reject

"Popular ⇒ safe." → A popular single-maintainer package with stale releases is a prime takeover target; weigh maintainers + cadence, not stars.
"No CVE ⇒ no risk." → Takeover/abandonment risk is forward-looking; past-CVE absence is irrelevant.
"List every transitive dep." → Stay on direct deps you control; note transitive concerns as nextChecks rather than flooding findings.