تشغيل أي مهارة في Manus بنقرة واحدة

javascript-supply-chain-security

Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

تشغيل في Manus

نظرة عامة

أمر التثبيت

npx skills add https://github.com/willfish/nix --skill javascript-supply-chain-security

انسخ والصق هذا الأمر في Claude Code لتثبيت المهارة

المصدر

willfish/nix

النجوم١

التفرعات٠

آخر تحديث٢٢ مايو ٢٠٢٦ في ١٨:٠٤

SKILL.md

readonly

name	javascript-supply-chain-security
description	Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

JavaScript Supply Chain Security

Use this skill before changing JavaScript dependencies, running install commands, reviewing package manager lockfiles, publishing npm packages, or handling npm/Yarn/pnpm/Bun security questions.

Read references/javascript-supply-chain-security.md for the current policy and checklist.

Default workflow:

Identify the package manager, lockfile, Node version, and current install command.
Inspect package.json, package-manager config, and lockfile status before running installs.
Preserve existing package-manager choice; do not introduce a second lockfile.
Keep lifecycle scripts disabled unless the package has been inspected and the bypass is scoped.
Prefer exact direct dependency versions and reproducible install commands.
Inspect manifest and lockfile diffs after changes.
Run the repo's relevant verification command before completion.
Report any script bypass, non-registry dependency, audit finding, or unresolved supply-chain risk.

المزيد من هذا المستودع

نفس المستودع

local-dev-environment

willfish/nix

Use when working with Will's dotfiles, Nix/Home Manager setup, direnv project environments, Brave remote debugging, local trade-tariff ports, or local service assumptions on this machine.

2026-06-031

superpowers

willfish/nix

Core agent discipline and workflow harness (adapted from Codex Superpowers). Establishes strict habits: always check for relevant skills before acting, use todo tracking on complex work, prefer plan mode for big changes, and verify before declaring completion. Use at the start of any non-trivial session or when you want maximum reliability and structure.

2026-06-011

using-superpowers

willfish/nix

Use when starting any conversation or before non-trivial work. Establishes how to find and invoke skills (Grok /skills injection or Read of SKILL.md) before ANY response, including clarifying questions. Pair with superpowers for session discipline.

2026-06-011

create-skill

willfish/nix

Interactively create a new Grok skill (SKILL.md + optional scripts/references). Use when the user wants to create a skill, scaffold a skill, or runs /create-skill.

2026-05-201

systematic-debugging

willfish/nix

Rigorous root-cause debugging process. Use for ANY bug, test failure, unexpected behavior, performance issue, or when previous fix attempts have failed. Forces you to find the real cause before proposing or applying any fixes. This is the single most effective way to stop thrashing and actually solve hard problems.

2026-05-201

verification-before-completion

willfish/nix

Mandatory verification gate before claiming any work is complete, fixed, or passing. Use when you are about to say "done", "fixed", "tests pass", "it works", or similar — requires fresh evidence from running the actual verification command(s) in the current context.

2026-05-201

المصدر

willfish

willfish/nix

فتح مستودع GitHub عرض مستودعات المنشئ

أمر التثبيت

تنزيل

تشغيل في Manus

مفيد لـSOC

محللو أمن المعلوماتمهن الحاسوب والرياضيات15-1212L4

name	javascript-supply-chain-security
description	Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

JavaScript Supply Chain Security

Use this skill before changing JavaScript dependencies, running install commands, reviewing package manager lockfiles, publishing npm packages, or handling npm/Yarn/pnpm/Bun security questions.

Read references/javascript-supply-chain-security.md for the current policy and checklist.

Default workflow:

Identify the package manager, lockfile, Node version, and current install command.
Inspect package.json, package-manager config, and lockfile status before running installs.
Preserve existing package-manager choice; do not introduce a second lockfile.
Keep lifecycle scripts disabled unless the package has been inspected and the bypass is scoped.
Prefer exact direct dependency versions and reproducible install commands.
Inspect manifest and lockfile diffs after changes.
Run the repo's relevant verification command before completion.
Report any script bypass, non-registry dependency, audit finding, or unresolved supply-chain risk.