Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

Commencer

triage

Étoiles0

Forks0

Mis à jour29 juin 2026 à 19:55

Guide agent supply-chain triage after Claude Code MCP, plugin, skill, hook, command, or settings changes.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

open-agent-security

open-agent-security/openaca-claude-plugin

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Développeurs de logicielsProfessions informatiques et mathématiques·SOC 15-1252

SKILL.md

readonly

name	triage
description	Guide agent supply-chain triage after Claude Code MCP, plugin, skill, hook, command, or settings changes.
argument-hint	[what changed]
allowed-tools	["Bash","Read"]

OpenACA Triage

Use this skill when the user has added or changed MCP servers, plugins, skills, hooks, commands, .claude/settings.json, or other agent runtime configuration and wants a security-oriented review.

Triage Flow

Identify the changed scope: endpoint config, project config, repo files, or a stored Agent BOM.
If the user only needs to see what changed, generate a fresh BOM and, when a previous BOM exists and the installed CLI supports it, compare the snapshots:

uvx --isolated --from openaca openaca bom endpoint --project . --output openaca-agent-bom.json
uvx --isolated --from openaca openaca bom diff --before openaca-agent-bom.previous.json --after openaca-agent-bom.json

Run the narrowest useful scan when the user wants advisory or posture evidence. Include posture findings — triage is exactly where configuration-hygiene issues (mutable install refs, insecure transport, missing remote auth) are most useful:

uvx --isolated --from openaca openaca scan endpoint -v --project . --include-posture

If the user only wants inventory and has no previous BOM, generate a BOM instead:

uvx --isolated --from openaca openaca bom endpoint --project . --output openaca-agent-bom.json

Summarize new or relevant components: plugins, MCP servers, skills, hooks, commands, and direct components.
Separate evidence classes: advisory matches, posture findings, and composition inventory.
Recommend next steps only where evidence supports them.

If uvx is unavailable but openaca is installed, use the same command without the uvx prefix.

Safety

Ask before making changes. Do not disable components, edit settings, or remove files without explicit user approval.

Plus depuis ce dépôt

même dépôt

inventory

open-agent-security/openaca-claude-plugin

Generate fast local OpenACA inventory from Claude Code endpoint or project configuration without running advisory lookups.

2026-06-290

scan

open-agent-security/openaca-claude-plugin

Run OpenACA scans from Claude Code when the user asks to scan agent components, check Claude Code configuration, inspect MCP servers/plugins/skills/hooks, or assess agent supply-chain risk.

2026-06-290

sync

open-agent-security/openaca-claude-plugin

Configure, check, or run explicit OpenACA Cloud sync for a Claude Code endpoint.

2026-06-290

bom

open-agent-security/openaca-claude-plugin

Generate an OpenACA Agent BOM when the user asks for a bill of materials, Agent BOM, inventory export, or structured list of agent components.

2026-06-120

explain

open-agent-security/openaca-claude-plugin

Explain OpenACA findings, Agent BOM entries, scan output, severity, confidence, source provenance, and suggested next steps.

2026-06-120

name	triage
description	Guide agent supply-chain triage after Claude Code MCP, plugin, skill, hook, command, or settings changes.
argument-hint	[what changed]
allowed-tools	["Bash","Read"]

OpenACA Triage

Use this skill when the user has added or changed MCP servers, plugins, skills, hooks, commands, .claude/settings.json, or other agent runtime configuration and wants a security-oriented review.

Triage Flow

Identify the changed scope: endpoint config, project config, repo files, or a stored Agent BOM.
If the user only needs to see what changed, generate a fresh BOM and, when a previous BOM exists and the installed CLI supports it, compare the snapshots:

uvx --isolated --from openaca openaca bom endpoint --project . --output openaca-agent-bom.json
uvx --isolated --from openaca openaca bom diff --before openaca-agent-bom.previous.json --after openaca-agent-bom.json

Run the narrowest useful scan when the user wants advisory or posture evidence. Include posture findings — triage is exactly where configuration-hygiene issues (mutable install refs, insecure transport, missing remote auth) are most useful:

uvx --isolated --from openaca openaca scan endpoint -v --project . --include-posture

If the user only wants inventory and has no previous BOM, generate a BOM instead:

uvx --isolated --from openaca openaca bom endpoint --project . --output openaca-agent-bom.json

Summarize new or relevant components: plugins, MCP servers, skills, hooks, commands, and direct components.
Separate evidence classes: advisory matches, posture findings, and composition inventory.
Recommend next steps only where evidence supports them.

If uvx is unavailable but openaca is installed, use the same command without the uvx prefix.

Safety

Ask before making changes. Do not disable components, edit settings, or remove files without explicit user approval.