[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7178HN419B68WH3TRTACFNH":3,"skill-same:01M7178HN419B68WH3TRTACFNH":69},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":14,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M7178HN419B68WH3TRTACFNH","supply-chain-risk-auditor",null,"Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fsupply-chain-risk-auditor\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"risk","auditor","supply","chain","supply chain risk","supply chain risk auditor","supply chain","community","when","unknown","at","dependencies","dependency","use","write","read","takeover","Bash","health","exploitation","2026-11-10 10:12:30",false,"---\nname: supply-chain-risk-auditor\ndescription: \"Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.\"\nallowed-tools:\n  - Read\n  - Write\n  - Bash\n  - Glob\n  - Grep\nrisk: unknown\nsource: community\n---\n\n# Supply Chain Risk Auditor\n\nActivates when the user says \"audit this project's dependencies\".\n\n## When to Use\n- Assessing dependency risk before a security audit\n- Evaluating supply chain attack surface of a project\n- Identifying unmaintained or risky dependencies\n- Pre-engagement scoping for supply chain concerns\n\n## When NOT to Use\n\n- Active vulnerability scanning (use dedicated tools like npm audit, pip-audit)\n- Runtime dependency analysis\n- License compliance auditing\n\n## Purpose\n\nYou systematically evaluate all dependencies of a project to identify red flags that indicate a high risk of exploitation or takeover. You generate a summary report noting these issues.\n\n### Risk Criteria\n\nA dependency is considered high-risk if it features any of the following risk factors:\n\n* **Single maintainer or team of individuals** - The project is primarily or solely maintained by a single individual, or a small number of individuals. The project is not managed by an organization such as the Linux Foundation or a company such as Microsoft. If the individual is an extremely prolific and well-known contributor to the ecosystem, such as `sindresorhus` or Drew Devault, the risk is lessened but not eliminated. Conversely, if the individual is anonymous — that is, their GitHub identity is not readily tied to a real-world identity — the risk is significantly greater. **Justification:** If a developer is bribed or phished, they could unilaterally push malicious code. Consider the left-pad incident.\n* **Unmaintained** - The project is stale (no updates for a long period of time) or explicitly deprecated\u002Farchived. The maintainer may have put a note in the README.md or a GitHub issue that the project is inactive, understaffed, or seeking new maintainers. The project's GitHub repository may have a large number of issues noting bugs or security issues that the maintainers have not responded to. Feature request issues do NOT count.  **Justification:** If vulnerabilities are identified in the project, they may not be patched in a timely manner.\n* **Low popularity:** The project has a relatively low number of GitHub stars and\u002For downloads compared to other dependencies used by the target. **Justification:** Fewer users means fewer eyes on the project. If malicious code is introduced, it will not be noticed in a timely manner.\n* **High-risk features:** The project implements features that by their nature are especially prone to exploitation, including FFI, deserialization, or third-party code execution. **Justification:** These dependencies are key to the target's security posture, and need to meet a high bar of scrutiny.\n* **Presence of past CVEs:** The project has high or critical severity CVEs, especially a large number relative to its popularity and complexity. **Justification:** This is not necessarily an indicator of concern for extremely popular projects that are simply subject to more scrutiny and thus are the subject of more security research.\n* **Absence of a security contact:** The project has no security contact listed in `.github\u002FSECURITY.md`, `CONTRIBUTING.md`, `README.md`, etc., or separately on the project's website (if one exists). **Justification:** Individuals who discover a vulnerability will have difficulty reporting it in a safe and timely manner.\n\n## Prerequisites\n\nEnsure that the `gh` tool is available before continuing. Ask the user to install if it is not found.\n\n## Workflow (Initial Setup)\n\nYou achieve your purpose by:\n\n1. Creating a `.supply-chain-risk-auditor` directory for your workspace\n\t* Start a `results.md` report file based on `results-template.md` in this directory\n2. Finding all git repositories for direct dependencies.\n3. Normalizing the git repository entries to URLs, i.e., if they are just in name\u002Fproject format, make sure to prepend the github URL.\n\n## Workflow (Dependency Audit)\n1. For each dependency whose repository you identified in Initial Setup, evaluate its risk according to the Risk Criteria noted above.\n\t* For any criteria that require actions such as counting open GitHub issues, use the `gh` tool to query the exact data. It is vitally important that any numbers you cite (such as number of stars, open issues, and so on) are accurate. You may round numbers of issues and stars using ~ notation, e.g. \"~4000 stars\".\n2. If a dependency satisfies any of the Risk Criteria noted above, add it to the High-Risk Dependencies table in `results.md`, clearly noting your reason for flagging it as high-risk. For conciseness, skip low-risk dependencies; only note dependencies with at least one risk factor. Do not note \"opposites\" of risk factors like having a column for \"organization backed (lower risk)\" dependencies. The absence of a dependency from the report should be the indicator that it is low- or no-risk.\n\n## Workflow (Post-Audit)\n1. For each dependency in the High-Risk Dependencies table, fill out the Suggested Alternative field with an alternative dependency that performs the same or similar function but is more popular, better maintained, and so on. Prefer direct successors and drop-in replacements if available. Provide a short justification of your suggestion.\n2. Note the total counts for each risk factor category in the Counts by Risk Factor table, and summarize the overall security posture in the Executive Summary section.\n3. Summarize your recommendations under the Recommendations section\n\n**NOTE:** Do not add sections beyond those noted in `results-template.md`.\n","# Supply Chain Risk Auditor\n\nActivates when the user says \"audit this project's dependencies\".\n\n## When to Use\n- Assessing dependency risk before a security audit\n- Evaluating supply chain attack surface of a project\n- Identifying unmaintained or risky dependencies\n- Pre-engagement scoping for supply chain concerns\n\n## When NOT to Use\n\n- Active vulnerability scanning (use dedicated tools like npm audit, pip-audit)\n- Runtime dependency analysis\n- License compliance auditing\n\n## Purpose\n\nYou systematically evaluate all dependencies of a project to identify red flags that indicate a high risk of exploitation or takeover. You generate a summary report noting these issues.\n\n### Risk Criteria\n\nA dependency is considered high-risk if it features any of the following risk factors:\n\n* **Single maintainer or team of individuals** - The project is primarily or solely maintained by a single individual, or a small number of individuals. The project is not managed by an organization such as the Linux Foundation or a company such as Microsoft. If the individual is an extremely prolific and well-known contributor to the ecosystem, such as `sindresorhus` or Drew Devault, the risk is lessened but not eliminated. Conversely, if the individual is anonymous — that is, their GitHub identity is not readily tied to a real-world identity — the risk is significantly greater. **Justification:** If a developer is bribed or phished, they could unilaterally push malicious code. Consider the left-pad incident.\n* **Unmaintained** - The project is stale (no updates for a long period of time) or explicitly deprecated\u002Farchived. The maintainer may have put a note in the README.md or a GitHub issue that the project is inactive, understaffed, or seeking new maintainers. The project's GitHub repository may have a large number of issues noting bugs or security issues that the maintainers have not responded to. Feature request issues do NOT count.  **Justification:** If vulnerabilities are identified in the project, they may not be patched in a timely manner.\n* **Low popularity:** The project has a relatively low number of GitHub stars and\u002For downloads compared to other dependencies used by the target. **Justification:** Fewer users means fewer eyes on the project. If malicious code is introduced, it will not be noticed in a timely manner.\n* **High-risk features:** The project implements features that by their nature are especially prone to exploitation, including FFI, deserialization, or third-party code execution. **Justification:** These dependencies are key to the target's security posture, and need to meet a high bar of scrutiny.\n* **Presence of past CVEs:** The project has high or critical severity CVEs, especially a large number relative to its popularity and complexity. **Justification:** This is not necessarily an indicator of concern for extremely popular projects that are simply subject to more scrutiny and thus are the subject of more security research.\n* **Absence of a security contact:** The project has no security contact listed in `.github\u002FSECURITY.md`, `CONTRIBUTING.md`, `README.md`, etc., or separately on the project's website (if one exists). **Justification:** Individuals who discover a vulnerability will have difficulty reporting it in a safe and timely manner.\n\n## Prerequisites\n\nEnsure that the `gh` tool is available before continuing. Ask the user to install if it is not found.\n\n## Workflow (Initial Setup)\n\nYou achieve your purpose by:\n\n1. Creating a `.supply-chain-risk-auditor` directory for your workspace\n\t* Start a `results.md` report file based on `results-template.md` in this directory\n2. Finding all git repositories for direct dependencies.\n3. Normalizing the git repository entries to URLs, i.e., if they are just in name\u002Fproject format, make sure to prepend the github URL.\n\n## Workflow (Dependency Audit)\n1. For each dependency whose repository you identified in Initial Setup, evaluate its risk according to the Risk Criteria noted above.\n\t* For any criteria that require actions such as counting open GitHub issues, use the `gh` tool to query the exact data. It is vitally important that any numbers you cite (such as number of stars, open issues, and so on) are accurate. You may round numbers of issues and stars using ~ notation, e.g. \"~4000 stars\".\n2. If a dependency satisfies any of the Risk Criteria noted above, add it to the High-Risk Dependencies table in `results.md`, clearly noting your reason for flagging it as high-risk. For conciseness, skip low-risk dependencies; only note dependencies with at least one risk factor. Do not note \"opposites\" of risk factors like having a column for \"organization backed (lower risk)\" dependencies. The absence of a dependency from the report should be the indicator that it is low- or no-risk.\n\n## Workflow (Post-Audit)\n1. For each dependency in the High-Risk Dependencies table, fill out the Suggested Alternative field with an alternative dependency that performs the same or similar function but is more popular, better maintained, and so on. Prefer direct successors and drop-in replacements if available. Provide a short justification of your suggestion.\n2. Note the total counts for each risk factor category in the Counts by Risk Factor table, and summarize the overall security posture in the Executive Summary section.\n3. Summarize your recommendations under the Recommendations section\n\n**NOTE:** Do not add sections beyond those noted in `results-template.md`.\n",{"name":5,"risk":28,"source":26,"description":7,"allowed-tools":44},[45,46,36,47,48],"Read","Write","Glob","Grep","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fcursor\u002Fsupply-chain-risk-auditor","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill supply-chain-risk-auditor",{"tool":61,"command":62},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill supply-chain-risk-auditor",{"tool":64,"command":65},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill supply-chain-risk-auditor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fsupply-chain-risk-auditor\u002FSKILL.md",true,[],[70,94,117,127,140,159],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":81,"publishedAt":39},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[76],{"categoryNo":77,"categoryName":78,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[82,83,84,85,86,87,88,89,90,91,92,93],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","web","official","fetch","with",{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":39},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[101,102,103,104,36,105,84,106,107,108,109,27,110,111,112,113,114,34,115,116],"trend","trend tap","tap","api keys","time","trending","hacker","aggregator","do","brew","live","data","google","install","across","api",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":39},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[124,125,101,110,111,112,113,36,84,34,126,115,116,27,108,107,106,114,105,104],"trend radar","radar","pulse",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":39},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[134,135,136,137,138,139],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":151,"publishedAt":39},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[146],{"categoryNo":147,"categoryName":148,"taxonomyType":149,"taxonomyTypeDesc":150},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[142,90,152,153,154,93,110,155,156,157,103,158,114],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":39},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[161,166,167,168,114,169,156,170,171,172,173,174],"status","play","go","latest","github","discover","control","cmd","volume"]