Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

javascript-supply-chain-security

Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

Ejecutar en Manus

Resumen

Comando de instalación

npx skills add https://github.com/willfish/nix --skill javascript-supply-chain-security

Copia y pega este comando en Claude Code para instalar la habilidad

Fuente

willfish/nix

Estrellas1

Forks0

Actualizado22 de mayo de 2026, 18:04

SKILL.md

readonly

name	javascript-supply-chain-security
description	Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

JavaScript Supply Chain Security

Use this skill before changing JavaScript dependencies, running install commands, reviewing package manager lockfiles, publishing npm packages, or handling npm/Yarn/pnpm/Bun security questions.

Read references/javascript-supply-chain-security.md for the current policy and checklist.

Default workflow:

Identify the package manager, lockfile, Node version, and current install command.
Inspect package.json, package-manager config, and lockfile status before running installs.
Preserve existing package-manager choice; do not introduce a second lockfile.
Keep lifecycle scripts disabled unless the package has been inspected and the bypass is scoped.
Prefer exact direct dependency versions and reproducible install commands.
Inspect manifest and lockfile diffs after changes.
Run the repo's relevant verification command before completion.
Report any script bypass, non-registry dependency, audit finding, or unresolved supply-chain risk.

Más de este repositorio

mismo repositorio

local-dev-environment

willfish/nix

Use when working with Will's dotfiles, Nix/Home Manager setup, direnv project environments, Brave remote debugging, local trade-tariff ports, or local service assumptions on this machine.

2026-06-031

superpowers

willfish/nix

Core agent discipline and workflow harness (adapted from Codex Superpowers). Establishes strict habits: always check for relevant skills before acting, use todo tracking on complex work, prefer plan mode for big changes, and verify before declaring completion. Use at the start of any non-trivial session or when you want maximum reliability and structure.

2026-06-011

using-superpowers

willfish/nix

Use when starting any conversation or before non-trivial work. Establishes how to find and invoke skills (Grok /skills injection or Read of SKILL.md) before ANY response, including clarifying questions. Pair with superpowers for session discipline.

2026-06-011

create-skill

willfish/nix

Interactively create a new Grok skill (SKILL.md + optional scripts/references). Use when the user wants to create a skill, scaffold a skill, or runs /create-skill.

2026-05-201

systematic-debugging

willfish/nix

Rigorous root-cause debugging process. Use for ANY bug, test failure, unexpected behavior, performance issue, or when previous fix attempts have failed. Forces you to find the real cause before proposing or applying any fixes. This is the single most effective way to stop thrashing and actually solve hard problems.

2026-05-201

verification-before-completion

willfish/nix

Mandatory verification gate before claiming any work is complete, fixed, or passing. Use when you are about to say "done", "fixed", "tests pass", "it works", or similar — requires fresh evidence from running the actual verification command(s) in the current context.

2026-05-201

Fuente

willfish

willfish/nix

Abrir repositorio de GitHub Ver repositorios del creador

Comando de instalación

Descarga

Ejecutar en Manus

Útil paraSOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas15-1212L4

name	javascript-supply-chain-security
description	Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

JavaScript Supply Chain Security

Use this skill before changing JavaScript dependencies, running install commands, reviewing package manager lockfiles, publishing npm packages, or handling npm/Yarn/pnpm/Bun security questions.

Read references/javascript-supply-chain-security.md for the current policy and checklist.

Default workflow:

Identify the package manager, lockfile, Node version, and current install command.
Inspect package.json, package-manager config, and lockfile status before running installs.
Preserve existing package-manager choice; do not introduce a second lockfile.
Keep lifecycle scripts disabled unless the package has been inspected and the bypass is scoped.
Prefer exact direct dependency versions and reproducible install commands.
Inspect manifest and lockfile diffs after changes.
Run the repo's relevant verification command before completion.
Report any script bypass, non-registry dependency, audit finding, or unresolved supply-chain risk.