| name | supply-chain-guard |
| description | Route npm and VS Code extension installs through Supply Chain Guard (scguard). Use when adding dependencies, running package managers, or installing extensions. Never call bun/npm/pnpm/yarn install or add directly when this project uses scguard. |
Supply Chain Guard
This project uses Supply Chain Guard to review packages before they are installed.
Install this skill with:
npx skills add pc-style/supply-chain-guard --skill supply-chain-guard -y
Or: scguard skill install
Rules for coding agents
- Do not run
bun add, bun install, npm install, pnpm add, yarn add, or code --install-extension unless the user explicitly bypasses scguard.
- Prefer
scguard review <package[@version]> to download and analyze without installing.
- Use
scguard install <package[@version]> when the dependency should be added after the gate passes.
- Assume exit code
1 from scguard review means high-risk findings — do not bypass unless the user explicitly requests it.
- Run
scguard doctor when installs fail unexpectedly (missing shell hook, Socket token, or agent CLIs).
Common commands
scguard review axios
scguard install lodash --dev
scguard scan-vsix ./extension.vsix
scguard doctor
eval "$(scguard shell-hook)"
