ワンクリックでManusで任意のスキルを実行

javascript-supply-chain-security

Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

Manusで実行

概要

インストールコマンド

npx skills add https://github.com/willfish/nix --skill javascript-supply-chain-security

このコマンドをClaude Codeにコピー＆ペーストしてスキルをインストール

ソース

willfish/nix

スター1

フォーク0

更新日2026年5月22日 18:04

SKILL.md

readonly

name	javascript-supply-chain-security
description	Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

JavaScript Supply Chain Security

Use this skill before changing JavaScript dependencies, running install commands, reviewing package manager lockfiles, publishing npm packages, or handling npm/Yarn/pnpm/Bun security questions.

Read references/javascript-supply-chain-security.md for the current policy and checklist.

Default workflow:

Identify the package manager, lockfile, Node version, and current install command.
Inspect package.json, package-manager config, and lockfile status before running installs.
Preserve existing package-manager choice; do not introduce a second lockfile.
Keep lifecycle scripts disabled unless the package has been inspected and the bypass is scoped.
Prefer exact direct dependency versions and reproducible install commands.
Inspect manifest and lockfile diffs after changes.
Run the repo's relevant verification command before completion.
Report any script bypass, non-registry dependency, audit finding, or unresolved supply-chain risk.

このリポジトリの他の Skills

同じリポジトリ

local-dev-environment

willfish/nix

Use when working with Will's dotfiles, Nix/Home Manager setup, direnv project environments, Brave remote debugging, local trade-tariff ports, or local service assumptions on this machine.

2026-06-031

superpowers

willfish/nix

Core agent discipline and workflow harness (adapted from Codex Superpowers). Establishes strict habits: always check for relevant skills before acting, use todo tracking on complex work, prefer plan mode for big changes, and verify before declaring completion. Use at the start of any non-trivial session or when you want maximum reliability and structure.

2026-06-011

using-superpowers

willfish/nix

Use when starting any conversation or before non-trivial work. Establishes how to find and invoke skills (Grok /skills injection or Read of SKILL.md) before ANY response, including clarifying questions. Pair with superpowers for session discipline.

2026-06-011

create-skill

willfish/nix

Interactively create a new Grok skill (SKILL.md + optional scripts/references). Use when the user wants to create a skill, scaffold a skill, or runs /create-skill.

2026-05-201

systematic-debugging

willfish/nix

Rigorous root-cause debugging process. Use for ANY bug, test failure, unexpected behavior, performance issue, or when previous fix attempts have failed. Forces you to find the real cause before proposing or applying any fixes. This is the single most effective way to stop thrashing and actually solve hard problems.

2026-05-201

verification-before-completion

willfish/nix

Mandatory verification gate before claiming any work is complete, fixed, or passing. Use when you are about to say "done", "fixed", "tests pass", "it works", or similar — requires fresh evidence from running the actual verification command(s) in the current context.

2026-05-201

ソース

willfish

willfish/nix

GitHub リポジトリを開く Creator のリポジトリを見る

インストールコマンド

ダウンロード

Manusで実行

役立つ用途SOC

情報セキュリティアナリストコンピュータ・数学職15-1212L4

name	javascript-supply-chain-security
description	Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

JavaScript Supply Chain Security

Use this skill before changing JavaScript dependencies, running install commands, reviewing package manager lockfiles, publishing npm packages, or handling npm/Yarn/pnpm/Bun security questions.

Read references/javascript-supply-chain-security.md for the current policy and checklist.

Default workflow:

Identify the package manager, lockfile, Node version, and current install command.
Inspect package.json, package-manager config, and lockfile status before running installs.
Preserve existing package-manager choice; do not introduce a second lockfile.
Keep lifecycle scripts disabled unless the package has been inspected and the bypass is scoped.
Prefer exact direct dependency versions and reproducible install commands.
Inspect manifest and lockfile diffs after changes.
Run the repo's relevant verification command before completion.
Report any script bypass, non-registry dependency, audit finding, or unresolved supply-chain risk.