菜单
Use when auditing AI-agent supply chain risk, prompt or skill provenance, dependency trust, SBOM/SLSA evidence, MCP tool-poisoning, package provenance, or agent runtime guardrails before release.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Autonomously port a module, script, CLI, or function from one language to another across the polyglot fleet — Rust, Python, Go, C++, Swift, TypeScript, JavaScript, Ruby, and Bash/Shell — preserving business logic exactly while adopting the target language's idioms, error model, concurrency shape, and toolchain, AND proving behavioural equivalence with a differential golden-I/O harness rather than eyeballing. Load when the user says "port this to <lang>", "translate to <lang>", "rewrite in <lang>", "convert this to <lang>", "reimplement <X> in <lang>", "give me the <lang> equivalent", or asks for a Rust↔Python↔Go↔Swift↔TS/JS↔Ruby↔C++ ↔Bash equivalent of existing code. Not for micro-snippets (do those inline) or behaviour-changing redesigns (that's a rewrite, clarify intent first).
Meta-router for the AgtMLS skill catalog — read this first when you are unsure which AgtMLS skill (if any) to load for a task, when several skills look like they might apply, or when onboarding to how this hub's skills and shared references fit together. Points at the cross-language-port skill for porting/translating code between languages, at project bundles (e.g. the noyalib/ family) for project-specific work, and at references/ for the shared Definition of Done. Use when the question is "which skill do I use for X" or "how do AgtMLS skills work".
Use when the user needs this reusable workflow. Replace this with trigger-rich wording that says when to load the skill, what task it handles, and when not to use it.
Use when preparing a pull request, reviewing implementation risk, writing release notes, checking CI, packaging artifacts, or deciding whether a repository is ready to ship.
Use when turning repeated agent work into a loop with trigger conditions, evidence, stopping criteria, uninstall state, validation checks, and reviewable artifacts.
Use when gathering current web evidence, comparing sources, triaging credibility, reading GitHub repositories, checking docs, or deciding whether a claim needs live verification.
| name | ai-supply-chain-security |
| description | Use when auditing AI-agent supply chain risk, prompt or skill provenance, dependency trust, SBOM/SLSA evidence, MCP tool-poisoning, package provenance, or agent runtime guardrails before release. |
| license | MIT |
Use this skill to audit agentic supply-chain risk before shipping an AI-enabled repository or skill pack.
SBOM.spdx.json, provenance.json, SHA256SUMS, and green agtmls.py check.Record reviewed files, commands run, and residual risks in the evidence log when available.