Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

javascript-supply-chain-security

Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

Executar no Manus

Visão geral

Comando de instalação

npx skills add https://github.com/willfish/nix --skill javascript-supply-chain-security

Copie e cole este comando no Claude Code para instalar a skill

Fonte

willfish/nix

Estrelas1

Forks0

Atualizado22 de maio de 2026 às 18:04

SKILL.md

readonly

name	javascript-supply-chain-security
description	Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

JavaScript Supply Chain Security

Use this skill before changing JavaScript dependencies, running install commands, reviewing package manager lockfiles, publishing npm packages, or handling npm/Yarn/pnpm/Bun security questions.

Read references/javascript-supply-chain-security.md for the current policy and checklist.

Default workflow:

Identify the package manager, lockfile, Node version, and current install command.
Inspect package.json, package-manager config, and lockfile status before running installs.
Preserve existing package-manager choice; do not introduce a second lockfile.
Keep lifecycle scripts disabled unless the package has been inspected and the bypass is scoped.
Prefer exact direct dependency versions and reproducible install commands.
Inspect manifest and lockfile diffs after changes.
Run the repo's relevant verification command before completion.
Report any script bypass, non-registry dependency, audit finding, or unresolved supply-chain risk.

Mais deste repositório

mesmo repositório

local-dev-environment

willfish/nix

Use when working with Will's dotfiles, Nix/Home Manager setup, direnv project environments, Brave remote debugging, local trade-tariff ports, or local service assumptions on this machine.

2026-06-031

superpowers

willfish/nix

Core agent discipline and workflow harness (adapted from Codex Superpowers). Establishes strict habits: always check for relevant skills before acting, use todo tracking on complex work, prefer plan mode for big changes, and verify before declaring completion. Use at the start of any non-trivial session or when you want maximum reliability and structure.

2026-06-011

using-superpowers

willfish/nix

Use when starting any conversation or before non-trivial work. Establishes how to find and invoke skills (Grok /skills injection or Read of SKILL.md) before ANY response, including clarifying questions. Pair with superpowers for session discipline.

2026-06-011

create-skill

willfish/nix

Interactively create a new Grok skill (SKILL.md + optional scripts/references). Use when the user wants to create a skill, scaffold a skill, or runs /create-skill.

2026-05-201

systematic-debugging

willfish/nix

Rigorous root-cause debugging process. Use for ANY bug, test failure, unexpected behavior, performance issue, or when previous fix attempts have failed. Forces you to find the real cause before proposing or applying any fixes. This is the single most effective way to stop thrashing and actually solve hard problems.

2026-05-201

verification-before-completion

willfish/nix

Mandatory verification gate before claiming any work is complete, fixed, or passing. Use when you are about to say "done", "fixed", "tests pass", "it works", or similar — requires fresh evidence from running the actual verification command(s) in the current context.

2026-05-201

Fonte

willfish

willfish/nix

Abrir repositório GitHub Ver repositórios do creator

Comando de instalação

Download

Executar no Manus

Útil paraSOC

Analistas de segurança da informaçãoInformática e Matemática15-1212L4

name	javascript-supply-chain-security
description	Use when working with npm, Yarn, pnpm, Bun, Node dependencies, package installs, lockfile diffs, dependency upgrades, package audits, JavaScript supply chain security, lifecycle scripts, npm tokens, package publishing, trusted publishing, or provenance.

JavaScript Supply Chain Security

Use this skill before changing JavaScript dependencies, running install commands, reviewing package manager lockfiles, publishing npm packages, or handling npm/Yarn/pnpm/Bun security questions.

Read references/javascript-supply-chain-security.md for the current policy and checklist.

Default workflow:

Identify the package manager, lockfile, Node version, and current install command.
Inspect package.json, package-manager config, and lockfile status before running installs.
Preserve existing package-manager choice; do not introduce a second lockfile.
Keep lifecycle scripts disabled unless the package has been inspected and the bypass is scoped.
Prefer exact direct dependency versions and reproducible install commands.
Inspect manifest and lockfile diffs after changes.
Run the repo's relevant verification command before completion.
Report any script bypass, non-registry dependency, audit finding, or unresolved supply-chain risk.