supply-chain-audit

Étoiles11

Forks2

Mis à jour14 juin 2026 à 15:38

Software supply chain audit — dependencies (CVEs, maintenance, licenses, transitive risk), build/CI integrity (SHA-pinned actions, lockfile, CI-only release), artifact integrity (checksums, signing, SBOM). Triggers on: "/supply-chain-audit", "supply-chain-audit", "dependency audit". Run before adding a dep, before a release, or for periodic review. Reports; does not change deps unless asked.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Source

HetCreep

HetCreep/CoalMine

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Métiers associésSOC

Basé sur la classification professionnelle SOC

Développeurs de logicielsProfessions informatiques et mathématiques·SOC 15-1252

Explorateur de fichiers

3 fichiers

SKILL.md

readonly

name	supply-chain-audit
description	Software supply chain audit — dependencies (CVEs, maintenance, licenses, transitive risk), build/CI integrity (SHA-pinned actions, lockfile, CI-only release), artifact integrity (checksums, signing, SBOM). Triggers on: "/supply-chain-audit", "supply-chain-audit", "dependency audit". Run before adding a dep, before a release, or for periodic review. Reports; does not change deps unless asked.

Supply-Chain Audit

Audit what the project trusts: deps, build pipeline, shipped artifact. Report; do NOT change deps unless asked.

1. Dependencies

Scope — honor .coalmine.json packageManifests if set: scan exactly those manifest/lockfile paths; else infer by inspecting the repo.
CVEs — run ecosystem auditor; cross-check every hit in GHSA/OSV/NVD. Cite advisory ID + affected range + fixed version. (Invoke source-grounding — never from memory.)
Maintenance — last release, commit recency, bus-factor, archived/deprecated flag.
License — flag copyleft inside permissive project, missing/unknown license.
Transitive — full tree; name the parent to bump for a transitive fix.
Behavior — phone home? install scripts? unexpected egress?

2. Build / CI

CI-only release builds?
Actions pinned to commit SHA (not floating tag)?
Lockfile committed + enforced in CI?
Minimal token scope? No pull_request_target?

3. Artifact

SHA-256 checksums published for every binary?
Signed (Authenticode/GPG)? Gap documented honestly?
SBOM generated?
User can verify before running?

Tooling

Per-ecosystem vuln/license/outdated commands + offline fallback: read references/tooling.md when selecting scanners.

Discipline

Ground every CVE/fixed-version in an advisory. Never from memory.
Don't auto-change deps — report + recommend; user decides (bumps break builds).
State what was NOT scanned. Blocked network scans → lockfile inspection fallback (see references/tooling.md), mark live checks N-A.

Fix mode (choice-gated)

After the report, present via ask_question:

Pin safe now — commit already-present unchanged lockfile, pin CI action to current SHA, add missing checksum step. Each: checkpoint → apply → verify.
Let me pick — user-selected fixes only.
Report only — change nothing.

NEVER auto-fix: dep version bump, lockfile regen (re-resolves entire transitive tree).

Output

Plus depuis ce dépôt

même dépôt

rot-canary

HetCreep/CoalMine

Code-health scan — dead code, bug-prone logic, resource leaks, concurrency bugs, silent failures, input-boundary issues, doc rot. Triggers on: "/rot-canary", "rot-canary", "code-health" (legacy aliases: "/rotcanary", "rotcanary"). Auto-runs at session end on touched files (QUICK, report only) via platform hooks — auto-wired by the Claude Code plugin, manual elsewhere. Run manually for fix mode. Reports; fixes on request via choice-gated menu.

World-class completeness audit — score a project's rules/standards/features against best-in-class exemplars, name the gaps, fill missing rules, adopt as binding, then offer to conform existing code. Triggers on keywords: "/gold-standard", "gold-standard", "audit rules", "are we world-class", "fill gaps", "complete our rules", "conform old code".

Compatibility and schema drift canary — checks for database schema migration safety, breaking API contract changes, serializable payload mismatches, and backward compatibility drift. Triggers on keywords: "/drift-canary", "drift-canary", "contract drift", "breaking changes". Use when changing DB schemas, API contracts, serialized payloads, or required config keys.

2026-07-2411

resilience-audit

HetCreep/CoalMine

Failure-mode audit (FMEA for software) — for each way the system can fail (network, storage, partial completion, crash, concurrency, bad input), check whether code DETECTS, HANDLES, RECOVERS, and COMMUNICATES it. Triggers on: "/resilience-audit", "resilience-audit", "FMEA audit". Use when touching network, storage, async, retry, or rollback paths. Flags data loss, silent-success-on-failure, missing rollback/retry/idempotency. Reports; does not fix unless asked.

2026-07-2411

name	supply-chain-audit
description	Software supply chain audit — dependencies (CVEs, maintenance, licenses, transitive risk), build/CI integrity (SHA-pinned actions, lockfile, CI-only release), artifact integrity (checksums, signing, SBOM). Triggers on: "/supply-chain-audit", "supply-chain-audit", "dependency audit". Run before adding a dep, before a release, or for periodic review. Reports; does not change deps unless asked.

Supply-Chain Audit

Audit what the project trusts: deps, build pipeline, shipped artifact. Report; do NOT change deps unless asked.

1. Dependencies

Scope — honor .coalmine.json packageManifests if set: scan exactly those manifest/lockfile paths; else infer by inspecting the repo.
CVEs — run ecosystem auditor; cross-check every hit in GHSA/OSV/NVD. Cite advisory ID + affected range + fixed version. (Invoke source-grounding — never from memory.)
Maintenance — last release, commit recency, bus-factor, archived/deprecated flag.
License — flag copyleft inside permissive project, missing/unknown license.
Transitive — full tree; name the parent to bump for a transitive fix.
Behavior — phone home? install scripts? unexpected egress?

2. Build / CI

CI-only release builds?
Actions pinned to commit SHA (not floating tag)?
Lockfile committed + enforced in CI?
Minimal token scope? No pull_request_target?

3. Artifact

SHA-256 checksums published for every binary?
Signed (Authenticode/GPG)? Gap documented honestly?
SBOM generated?
User can verify before running?

Tooling

Per-ecosystem vuln/license/outdated commands + offline fallback: read references/tooling.md when selecting scanners.

Discipline

Ground every CVE/fixed-version in an advisory. Never from memory.
Don't auto-change deps — report + recommend; user decides (bumps break builds).
State what was NOT scanned. Blocked network scans → lockfile inspection fallback (see references/tooling.md), mark live checks N-A.

Fix mode (choice-gated)

After the report, present via ask_question:

Pin safe now — commit already-present unchanged lockfile, pin CI action to current SHA, add missing checksum step. Each: checkpoint → apply → verify.
Let me pick — user-selected fixes only.
Report only — change nothing.

NEVER auto-fix: dep version bump, lockfile regen (re-resolves entire transitive tree).

Output