[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CAP4F4V8Z8ZVKFV7FWE5VG":3,"skill-same:01M6CAP4F4V8Z8ZVKFV7FWE5VG":80},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":61,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M6CAP4F4V8Z8ZVKFV7FWE5VG","supply-chain-hardening-quickstart",null,"Orchestrate a pragmatic npm supply-chain hardening pass: dependency-source audit, release-age gate, lifecycle-script review, trusted publishing, signed releases, SBOM, and user verification docs.","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fsupply-chain-hardening-quickstart\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"supply","chain","quickstart","supply chain","hardening","supply chain hardening quickstart","user","source","age","pragmatic","gate","releases","publishing","dependency","review","lifecycle","supply-chain","SBOM","audit","orchestrate","npm","verification","release","docs","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: supply-chain-hardening-quickstart\nplatforms: [all]\ndescription: \"Orchestrate a pragmatic npm supply-chain hardening pass: dependency-source audit, release-age gate, lifecycle-script review, trusted publishing, signed releases, SBOM, and user verification docs.\"\n---\n\n# supply-chain-hardening-quickstart\n\nUse this skill when a user asks to harden an npm project after a\nsupply-chain incident, prepare a release pipeline for trusted\npublishing, or give their users verification instructions.\n\n## Runbook\n\n1. Run `npm-supply-chain-audit` to find the current exposure.\n2. Run `npm-release-age-gate` to configure the 7-day default and\n   10-day high-sensitivity profile.\n3. Use `supply-chain-trust` for broader release evidence: signed tags,\n   provenance, cosign signatures, SBOM, and reproducible-build tradeoffs.\n4. Produce user-facing docs that explain:\n   - runtime Node\u002Fnpm requirements,\n   - contributor lockfile requirements,\n   - release-publisher requirements,\n   - how to verify provenance, signatures, and SBOMs,\n   - what to rotate if a malicious package ran.\n\n## Minimum issue set\n\nFile or verify issues for:\n\n- Remove install lifecycle scripts or document why each one must remain.\n- Block Git, GitHub shorthand, direct tarball, `file:`, and `link:` dep\n  sources outside an allowlist.\n- Add a known-affected package feed scan and document how CI points it at\n  the current CSV snapshot (local path or raw gist URL).\n- Add `.npmrc` `min-release-age=7`.\n- Document npm 11.5+ for dependency updates.\n- Move npmjs.org release publishing to trusted publishing where possible.\n- Add signed tag verification before release workflows publish.\n- Add tarball audit, npm audit signatures, and SBOM generation.\n- Add consumer verification docs.\n\n## Completion criteria\n\n- A clean audit result exists with file:line findings or explicit clean\n  checks.\n- Known-affected exact matches are distinguished from advisory-vuln\n  results and include package\u002Fversion\u002Fpublished\u002Fdetected evidence.\n- Users can install without lifecycle-script surprises.\n- Contributors know when npm 11.5+ is required.\n- Release engineers use Node 24 or another environment satisfying npm\n  trusted-publishing requirements.\n- Public docs explain verification without asking users to trust the\n  registry alone.\n","# supply-chain-hardening-quickstart\n\nUse this skill when a user asks to harden an npm project after a\nsupply-chain incident, prepare a release pipeline for trusted\npublishing, or give their users verification instructions.\n\n## Runbook\n\n1. Run `npm-supply-chain-audit` to find the current exposure.\n2. Run `npm-release-age-gate` to configure the 7-day default and\n   10-day high-sensitivity profile.\n3. Use `supply-chain-trust` for broader release evidence: signed tags,\n   provenance, cosign signatures, SBOM, and reproducible-build tradeoffs.\n4. Produce user-facing docs that explain:\n   - runtime Node\u002Fnpm requirements,\n   - contributor lockfile requirements,\n   - release-publisher requirements,\n   - how to verify provenance, signatures, and SBOMs,\n   - what to rotate if a malicious package ran.\n\n## Minimum issue set\n\nFile or verify issues for:\n\n- Remove install lifecycle scripts or document why each one must remain.\n- Block Git, GitHub shorthand, direct tarball, `file:`, and `link:` dep\n  sources outside an allowlist.\n- Add a known-affected package feed scan and document how CI points it at\n  the current CSV snapshot (local path or raw gist URL).\n- Add `.npmrc` `min-release-age=7`.\n- Document npm 11.5+ for dependency updates.\n- Move npmjs.org release publishing to trusted publishing where possible.\n- Add signed tag verification before release workflows publish.\n- Add tarball audit, npm audit signatures, and SBOM generation.\n- Add consumer verification docs.\n\n## Completion criteria\n\n- A clean audit result exists with file:line findings or explicit clean\n  checks.\n- Known-affected exact matches are distinguished from advisory-vuln\n  results and include package\u002Fversion\u002Fpublished\u002Fdetected evidence.\n- Users can install without lifecycle-script surprises.\n- Contributors know when npm 11.5+ is required.\n- Release engineers use Node 24 or another environment satisfying npm\n  trusted-publishing requirements.\n- Public docs explain verification without asking users to trust the\n  registry alone.\n",{"name":5,"namespace":53,"platforms":54,"description":7},"aiwg",[55],"all","main","6754967c344ccb087a8de06972f55a41067b291b","agentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fsupply-chain-hardening-quickstart",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-14 02:10:01",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add jmagly\u002Faiwg --skill supply-chain-hardening-quickstart",{"tool":72,"command":73},"bunx","bunx skills add jmagly\u002Faiwg --skill supply-chain-hardening-quickstart",{"tool":75,"command":76},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill supply-chain-hardening-quickstart","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fsupply-chain-hardening-quickstart\u002FSKILL.md",true,[],[81,106,130,136,143,157],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":88,"publishedAt":48},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[87],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[89,90,28,91,92,93,94,95,96,45,97,98,99,100,42,101,102,103,104,105],"host","host hardening","read","re","recommendations","remediation","plan","port","Bash","access","only","retention","never","firewall","bind","secrets","request",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":116,"publishedAt":48},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[112,115],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[117,118,119,91,120,96,121,122,97,123,89,124,99,125,126,101,102,127,128,129],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator","write",{"skillNo":131,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":48},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[134],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[28,89,90,98,91,105,94,93,42,95,96,45,97,104,99,100,92,101,102,103],{"skillNo":137,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":142,"publishedAt":48},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[140,141],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[118,117,101,120,96,121,97,119,89,124,99,125,126,91,102,123,122,127,128,129],{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":48},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[149],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[151,152,153,154,155,156],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":48},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[163],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[165,166,125,167,152],"pi","pi local","duplicate"]