一键在 Manus 中运行任何 Skill

aigate-check

Check any package for supply chain attacks before installing. Use when: pip install, npm install, yarn add, pnpm add, cargo add, gem install, composer require, flutter pub add, go get, dotnet add package. Also use when someone suggests installing a package or dependency. ALWAYS run this before installing anything — no exceptions.

在 Manus 中运行

概览

安装命令

npx skills add https://github.com/ImL1s/aigate --skill aigate-check

复制此命令并粘贴到 Claude Code 中以安装该技能

来源

ImL1s/aigate

星标2

分支1

更新时间2026年3月29日 06:28

SKILL.md

readonly

name	aigate-check
description	Check any package for supply chain attacks before installing. Use when: pip install, npm install, yarn add, pnpm add, cargo add, gem install, composer require, flutter pub add, go get, dotnet add package. Also use when someone suggests installing a package or dependency. ALWAYS run this before installing anything — no exceptions.

When to trigger

You MUST run aigate check before ANY of these actions:

pip install, uv add, uv pip install, poetry add
npm install, npm add, yarn add, pnpm add
cargo add, cargo install
gem install, bundle add
composer require
flutter pub add, dart pub add
go get
dotnet add package, nuget install
Any time a user, document, or AI suggests adding a dependency

How to use

aigate check <package_name> -e <ecosystem>

Ecosystem mapping

Install command	Ecosystem flag
pip install / uv add / poetry add	`-e pypi`
npm install / yarn add / pnpm add	`-e npm`
cargo add / cargo install	`-e cargo`
gem install / bundle add	`-e gem`
composer require	`-e composer`
flutter pub add / dart pub add	`-e pub`
go get	`-e go`
dotnet add package / nuget install	`-e nuget`

Examples

# Python package
aigate check requests -e pypi

# npm package with version
aigate check lodash -e npm -v 4.17.21

# Local source directory
aigate check mylib --local ./vendor/mylib

# Rust crate
aigate check serde -e cargo

Interpret exit codes

Exit 0 = SAFE. Proceed with installation.
Exit 1 = SUSPICIOUS. Warn the user about potential risks before proceeding. Show the risk signals found.
Exit 2 = MALICIOUS. DO NOT install. Inform the user immediately and suggest alternatives.
Exit 3 = ERROR. aigate could not complete the check. Warn the user and suggest running with --skip-ai for static analysis only.

If aigate is not installed

pip install aigate
# or
uv pip install aigate

Then re-run the check.

Important

Never skip this step, even for well-known packages.
If the user insists on installing a flagged package, inform them of the risks first.
For multiple packages, check each one individually.

同仓库更多 Skills

同仓库

add-backend

ImL1s/aigate

Scaffold a new AI backend that implements AIBackend.analyze() — add file under src/aigate/backends/, register in BACKEND_MAP, wire unit tests. Use when adding support for a new AI model / provider.

2026-04-212

e2e

ImL1s/aigate

Run only the E2E test suite (no full 705-test unit battery). Two modes — Docker-sandboxed (scripts/run-e2e.sh) or direct pytest (tests/e2e/).

2026-04-212

release

ImL1s/aigate

Cut a new PyPI release — bump version in pyproject.toml, run scripts/publish.sh, tag, and hand off the final `uv publish` step to the user.

2026-04-212

aigate-scan

ImL1s/aigate

Scan a lockfile or requirements file for supply chain attacks. Use when: reviewing requirements.txt, package-lock.json, Cargo.lock, Gemfile.lock, composer.lock, pubspec.lock, go.sum, yarn.lock, pnpm-lock.yaml. Also use when auditing project dependencies or onboarding to a new codebase. ALWAYS run this when you see a lockfile or dependency manifest.

2026-03-292

check-package

ImL1s/aigate

Analyze a package with aigate CLI (static pre-filter + optional AI analysis). Usage: /check-package <name> [version] [ecosystem]

2026-03-282

verify

ImL1s/aigate

Run lint, format check, and all tests to verify code quality before committing.

2026-03-282

来源

ImL1s

ImL1s/aigate

打开 GitHub 仓库查看创作者相关仓库

安装命令

下载

在 Manus 中运行

适用职业SOC

信息安全分析师计算机与数学类职业15-1212L4

name	aigate-check
description	Check any package for supply chain attacks before installing. Use when: pip install, npm install, yarn add, pnpm add, cargo add, gem install, composer require, flutter pub add, go get, dotnet add package. Also use when someone suggests installing a package or dependency. ALWAYS run this before installing anything — no exceptions.

When to trigger

You MUST run aigate check before ANY of these actions:

pip install, uv add, uv pip install, poetry add
npm install, npm add, yarn add, pnpm add
cargo add, cargo install
gem install, bundle add
composer require
flutter pub add, dart pub add
go get
dotnet add package, nuget install
Any time a user, document, or AI suggests adding a dependency

How to use

aigate check <package_name> -e <ecosystem>

Ecosystem mapping

Install command	Ecosystem flag
pip install / uv add / poetry add	`-e pypi`
npm install / yarn add / pnpm add	`-e npm`
cargo add / cargo install	`-e cargo`
gem install / bundle add	`-e gem`
composer require	`-e composer`
flutter pub add / dart pub add	`-e pub`
go get	`-e go`
dotnet add package / nuget install	`-e nuget`

Examples

# Python package
aigate check requests -e pypi

# npm package with version
aigate check lodash -e npm -v 4.17.21

# Local source directory
aigate check mylib --local ./vendor/mylib

# Rust crate
aigate check serde -e cargo

Interpret exit codes

Exit 0 = SAFE. Proceed with installation.
Exit 1 = SUSPICIOUS. Warn the user about potential risks before proceeding. Show the risk signals found.
Exit 2 = MALICIOUS. DO NOT install. Inform the user immediately and suggest alternatives.
Exit 3 = ERROR. aigate could not complete the check. Warn the user and suggest running with --skip-ai for static analysis only.

If aigate is not installed

pip install aigate
# or
uv pip install aigate

Then re-run the check.

Important

Never skip this step, even for well-known packages.
If the user insists on installing a flagged package, inform them of the risks first.
For multiple packages, check each one individually.