Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

javascript-supply-chain-security

Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

Exécuter dans Manus

Aperçu

Commande d'installation

npx skills add https://github.com/willfish/nix --skill javascript-supply-chain-security

Copiez et collez cette commande dans Claude Code pour installer le skill

Source

willfish/nix

Étoiles1

Forks0

Mis à jour22 mai 2026 à 18:04

SKILL.md

readonly

name	javascript-supply-chain-security
description	Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

JavaScript Supply Chain Security

Use this skill before changing JavaScript dependencies, running install commands, reviewing package manager lockfiles, publishing npm packages, or handling npm/Yarn/pnpm/Bun security questions.

Read references/javascript-supply-chain-security.md for the current policy and checklist.

Default workflow:

Identify the package manager, lockfile, Node version, and current install command.
Inspect package.json, package-manager config, and lockfile status before running installs.
Preserve existing package-manager choice; do not introduce a second lockfile.
Keep lifecycle scripts disabled unless the package has been inspected and the bypass is scoped.
Prefer exact direct dependency versions and reproducible install commands.
Inspect manifest and lockfile diffs after changes.
Run the repo's relevant verification command before completion.
Report any script bypass, non-registry dependency, audit finding, or unresolved supply-chain risk.

Plus depuis ce dépôt

même dépôt

local-dev-environment

willfish/nix

Use when working with Will's dotfiles, Nix/Home Manager setup, direnv project environments, Brave remote debugging, local trade-tariff ports, or local service assumptions on this machine.

2026-06-031

superpowers

willfish/nix

Core agent discipline and workflow harness (adapted from Codex Superpowers). Establishes strict habits: always check for relevant skills before acting, use todo tracking on complex work, prefer plan mode for big changes, and verify before declaring completion. Use at the start of any non-trivial session or when you want maximum reliability and structure.

2026-06-011

using-superpowers

willfish/nix

Use when starting any conversation or before non-trivial work. Establishes how to find and invoke skills (Grok /skills injection or Read of SKILL.md) before ANY response, including clarifying questions. Pair with superpowers for session discipline.

2026-06-011

create-skill

willfish/nix

Interactively create a new Grok skill (SKILL.md + optional scripts/references). Use when the user wants to create a skill, scaffold a skill, or runs /create-skill.

2026-05-201

systematic-debugging

willfish/nix

Rigorous root-cause debugging process. Use for ANY bug, test failure, unexpected behavior, performance issue, or when previous fix attempts have failed. Forces you to find the real cause before proposing or applying any fixes. This is the single most effective way to stop thrashing and actually solve hard problems.

2026-05-201

verification-before-completion

willfish/nix

Mandatory verification gate before claiming any work is complete, fixed, or passing. Use when you are about to say "done", "fixed", "tests pass", "it works", or similar — requires fresh evidence from running the actual verification command(s) in the current context.

2026-05-201

Source

willfish

willfish/nix

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Commande d'installation

Téléchargement

Exécuter dans Manus

Utile pourSOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques15-1212L4

name	javascript-supply-chain-security
description	Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

JavaScript Supply Chain Security

Use this skill before changing JavaScript dependencies, running install commands, reviewing package manager lockfiles, publishing npm packages, or handling npm/Yarn/pnpm/Bun security questions.

Read references/javascript-supply-chain-security.md for the current policy and checklist.

Default workflow:

Identify the package manager, lockfile, Node version, and current install command.
Inspect package.json, package-manager config, and lockfile status before running installs.
Preserve existing package-manager choice; do not introduce a second lockfile.
Keep lifecycle scripts disabled unless the package has been inspected and the bypass is scoped.
Prefer exact direct dependency versions and reproducible install commands.
Inspect manifest and lockfile diffs after changes.
Run the repo's relevant verification command before completion.
Report any script bypass, non-registry dependency, audit finding, or unresolved supply-chain risk.