| name | supplyguard |
| description | Dependency supply-chain check before a package lands. Triggers when adding or bumping any dependency — package.json, requirements.txt, pyproject.toml, go.mod, Gemfile, Cargo.toml — or when running npm/pnpm/yarn/pip install, and on "is this package safe / real / maintained?". Catches hallucinated and typosquatted names, known-vulnerable versions, and weak trust signals. Guidance the model follows before it writes the dependency — it is not interception. |
| allowed-tools | Read, Grep, Glob, Bash |
SupplyGuard — check the package before you write it down
The single highest-value moment in supply-chain safety is before a name reaches a manifest. A hallucinated
package name is not a typo — it is an open slot an attacker can register. Check first, write second.
1. Existence — the one that catches hallucinations
Confirm the exact name resolves on its registry. Do not eyeball this; run it.
npm view <pkg> version
pip index versions <pkg>
go list -m -versions <module>
gem list -r -e <gem>
cargo search <crate> --limit 1
A name that is a near-miss of a popular package (reqeusts, lodahs, python-dateutils) is a typosquat or a
hallucination — do not add it, and show the correct name. If you cannot check (offline, no registry access),
say so and let the developer decide. An unverified dependency is a decision for the human, not a default.
2. Known vulnerabilities
npm audit --json
osv-scanner --lockfile=<path>
pip-audit
Vulnerable → report the advisory and the safe minimum version. Prefer the smallest bump that clears it.
3. Trust signals
Brand-new, unmaintained, single-maintainer, no repository link, or a version count of 1 → flag for a second
look. Weigh against how deep it sits: a build-time dev dependency and a runtime dependency handling untrusted
input are not the same risk. Prefer a maintained, widely-used alternative, or the standard library.
Report
One line per dependency: OK · STOP <reason> · WARN <advisory> → <safe version>.
STOP means you do not write the dependency and you tell the developer why. That is a choice you make, not
a gate that exists — say so honestly. If a rule must hold even when the model is talked out of it, that belongs
in a PreToolUse hook the developer installs deliberately.
The deeper pass is sec-deps (SBOM, install scripts, pinning, integrity). This skill is the fast check at the
moment of adding. See docs/ECOSYSTEM.md.
