[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C2GDB9BHDRKGWPYN3QBTM5":3,"skill-same:01M6C2GDB9BHDRKGWPYN3QBTM5":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":60,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M6C2GDB9BHDRKGWPYN3QBTM5","supply-chain-hardening-quickstart",null,"Orchestrate a pragmatic npm supply-chain hardening pass: dependency-source audit, release-age gate, lifecycle-script review, trusted publishing, signed releases, SBOM, and user verification docs.","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsupply-chain-hardening-quickstart\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"supply","chain","quickstart","supply chain","hardening","supply chain hardening quickstart","lifecycle","source","age","pragmatic","releases","publishing","dependency","user","review","supply-chain","SBOM","audit","orchestrate","npm","verification","release","docs","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: supply-chain-hardening-quickstart\nplatforms: [all]\ndescription: \"Orchestrate a pragmatic npm supply-chain hardening pass: dependency-source audit, release-age gate, lifecycle-script review, trusted publishing, signed releases, SBOM, and user verification docs.\"\n---\n\n# supply-chain-hardening-quickstart\n\nUse this skill when a user asks to harden an npm project after a\nsupply-chain incident, prepare a release pipeline for trusted\npublishing, or give their users verification instructions.\n\n## Runbook\n\n1. Run `npm-supply-chain-audit` to find the current exposure.\n2. Run `npm-release-age-gate` to configure the 7-day default and\n   10-day high-sensitivity profile.\n3. Use `supply-chain-trust` for broader release evidence: signed tags,\n   provenance, cosign signatures, SBOM, and reproducible-build tradeoffs.\n4. Produce user-facing docs that explain:\n   - runtime Node\u002Fnpm requirements,\n   - contributor lockfile requirements,\n   - release-publisher requirements,\n   - how to verify provenance, signatures, and SBOMs,\n   - what to rotate if a malicious package ran.\n\n## Minimum issue set\n\nFile or verify issues for:\n\n- Remove install lifecycle scripts or document why each one must remain.\n- Block Git, GitHub shorthand, direct tarball, `file:`, and `link:` dep\n  sources outside an allowlist.\n- Add a known-affected package feed scan and document how CI points it at\n  the current CSV snapshot (local path or raw gist URL).\n- Add `.npmrc` `min-release-age=7`.\n- Document npm 11.5+ for dependency updates.\n- Move npmjs.org release publishing to trusted publishing where possible.\n- Add signed tag verification before release workflows publish.\n- Add tarball audit, npm audit signatures, and SBOM generation.\n- Add consumer verification docs.\n\n## Completion criteria\n\n- A clean audit result exists with file:line findings or explicit clean\n  checks.\n- Known-affected exact matches are distinguished from advisory-vuln\n  results and include package\u002Fversion\u002Fpublished\u002Fdetected evidence.\n- Users can install without lifecycle-script surprises.\n- Contributors know when npm 11.5+ is required.\n- Release engineers use Node 24 or another environment satisfying npm\n  trusted-publishing requirements.\n- Public docs explain verification without asking users to trust the\n  registry alone.\n","# supply-chain-hardening-quickstart\n\nUse this skill when a user asks to harden an npm project after a\nsupply-chain incident, prepare a release pipeline for trusted\npublishing, or give their users verification instructions.\n\n## Runbook\n\n1. Run `npm-supply-chain-audit` to find the current exposure.\n2. Run `npm-release-age-gate` to configure the 7-day default and\n   10-day high-sensitivity profile.\n3. Use `supply-chain-trust` for broader release evidence: signed tags,\n   provenance, cosign signatures, SBOM, and reproducible-build tradeoffs.\n4. Produce user-facing docs that explain:\n   - runtime Node\u002Fnpm requirements,\n   - contributor lockfile requirements,\n   - release-publisher requirements,\n   - how to verify provenance, signatures, and SBOMs,\n   - what to rotate if a malicious package ran.\n\n## Minimum issue set\n\nFile or verify issues for:\n\n- Remove install lifecycle scripts or document why each one must remain.\n- Block Git, GitHub shorthand, direct tarball, `file:`, and `link:` dep\n  sources outside an allowlist.\n- Add a known-affected package feed scan and document how CI points it at\n  the current CSV snapshot (local path or raw gist URL).\n- Add `.npmrc` `min-release-age=7`.\n- Document npm 11.5+ for dependency updates.\n- Move npmjs.org release publishing to trusted publishing where possible.\n- Add signed tag verification before release workflows publish.\n- Add tarball audit, npm audit signatures, and SBOM generation.\n- Add consumer verification docs.\n\n## Completion criteria\n\n- A clean audit result exists with file:line findings or explicit clean\n  checks.\n- Known-affected exact matches are distinguished from advisory-vuln\n  results and include package\u002Fversion\u002Fpublished\u002Fdetected evidence.\n- Users can install without lifecycle-script surprises.\n- Contributors know when npm 11.5+ is required.\n- Release engineers use Node 24 or another environment satisfying npm\n  trusted-publishing requirements.\n- Public docs explain verification without asking users to trust the\n  registry alone.\n",{"name":5,"namespace":52,"platforms":53,"description":7},"aiwg",[54],"all","main","6754967c344ccb087a8de06972f55a41067b291b","agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsupply-chain-hardening-quickstart",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-12 00:33:10",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add jmagly\u002Faiwg --skill supply-chain-hardening-quickstart",{"tool":71,"command":72},"bunx","bunx skills add jmagly\u002Faiwg --skill supply-chain-hardening-quickstart",{"tool":74,"command":75},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill supply-chain-hardening-quickstart","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fsupply-chain-hardening-quickstart\u002FSKILL.md",true,[],[80,105,129,135,142,156],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":87,"publishedAt":47},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[86],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[88,89,28,90,91,92,93,94,95,44,96,97,98,99,41,100,101,102,103,104],"host","host hardening","read","re","recommendations","remediation","plan","port","Bash","access","only","retention","never","firewall","bind","secrets","request",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":115,"publishedAt":47},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[111,114],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118,90,119,95,120,121,96,122,88,123,98,124,125,100,101,126,127,128],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator","write",{"skillNo":130,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":47},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[133],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[28,88,89,97,90,104,93,92,41,94,95,44,96,103,98,99,91,100,101,102],{"skillNo":136,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":141,"publishedAt":47},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[139,140],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[117,116,100,119,95,120,96,118,88,123,98,124,125,90,101,122,121,126,127,128],{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":47},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[148],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[150,151,152,153,154,155],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":47},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[162],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[164,165,124,166,151],"pi","pi local","duplicate"]