[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M740GA0B6SC30K77HDXMVT9B":3,"skill-same:01M740GA0B6SC30K77HDXMVT9B":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":14,"repositoryHtmlUrl":43,"repositoryHomepageUrl":6,"ownerHtmlUrl":44,"ownerBlogUrl":6,"ownerDescription":45,"updatedAt":46,"install":47,"resources":60},"01M740GA0B6SC30K77HDXMVT9B","dependency-supply-chain-reviewer",null,"Review dependencies, lockfiles, package managers, container images, actions, and supply-chain risks.","domehahn\u002Fskcr","domehahn","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F41511445?v=4","01M735R3R9KEBEJ6D5YYAE9A61","Dominik Hahn","01M735R3SCNX1SGB3T840Z1H3H",0,"MIT","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fdependency-supply-chain-reviewer\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fdependency-supply-chain-reviewer\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: dependency-supply-chain-reviewer\ndescription: Review dependencies, lockfiles, package managers, container images, actions, and supply-chain risks.\nversion: \"1.1.0\"\nsince: \"2026-06-10\"\nlast_modified: \"2026-06-10\"\nauthors:\n  - platform-engineering\nstability: stable\nmin_platform_version:\n  codex: \"unknown\"\n  claude-code: \"unknown\"\n  github-copilot: \"unknown\"\n  gitlab-duo: \"unknown\"\n  opencode: \"unknown\"\n  openhands: \"unknown\"\n  cursor: \"unknown\"\n  roo-code: \"unknown\"\n  kiro: \"unknown\"\n  junie: \"unknown\"\n  gemini-cli: \"unknown\"\n  windsurf: \"unknown\"\n  ollama: \"unknown\"\ndeprecated_since:\nreplaces:\nsupersedes: []\nchangelog:\n  - version: \"1.1.0\"\n    date: \"2026-06-10\"\n    change: \"Added production-ready skill-specific operating model, checklist, decision rules, acceptance criteria, and output requirements\"\n  - version: \"1.0.0\"\n    date: \"2025-01-01\"\n    change: \"Initial release\"\n---\n\n# Dependency Supply Chain Reviewer\n\n## Purpose\n\nReview dependencies, lockfiles, package managers, container images, actions, and supply-chain risks.\n\n## When to use\n\nUse this skill when the task matches the description above or when the central agent instructions route work to `$dependency-supply-chain-reviewer`.\n\n## Operating model\n\n1. Clarify the goal and constraints.\n2. Inspect the minimum relevant repository context.\n3. Produce a concise execution plan for non-trivial work.\n4. Execute with tools when implementation is requested.\n5. Validate the result with repository-native checks.\n6. Summarize changed files, validation results, and residual risks.\n\n## DevSecOps guardrails\n\n- Do not read secrets, `.env` files, private keys, production credentials, masked CI\u002FCD variables, database dumps, or sensitive logs unless explicitly required.\n- Do not push, deploy, publish, merge, or create releases unless explicitly asked.\n- Prefer merge requests, reviewable diffs, and auditable validation evidence.\n- Prefer least privilege, minimal changes, and explicit rollback notes.\n- Do not fabricate test results, repository state, commands, or security findings.\n\n## Skill-Specific Operating Model\n\n- Inventory package manifests, lockfiles, vendored code, container bases, CI actions, generators, and release tooling.\n- Prioritize dependencies that execute code during install, build, CI, or production startup.\n- Review version pinning, registry trust, provenance, checksums, update governance, and transitive risk.\n\n## Skill-Specific Checklist\n\n- Manifests and lockfiles are present, consistent, and committed where expected.\n- Third-party actions, images, and tools avoid mutable references or have documented governance.\n- Install scripts, postinstall hooks, generated code, and vendored changes are reviewed as executable supply-chain surface.\n\n## Decision Rules\n\n- Block on dependency sources that can execute unreviewed code in privileged CI or release jobs.\n- Do not recommend blanket upgrades; tie updates to risk, compatibility, or policy.\n- Treat unknown vulnerability status as residual risk, not proof of safety.\n\n## Acceptance Criteria\n\n- Relevant ecosystems and lockfiles are inspected or explicitly marked absent.\n- Findings include dependency\u002Fimage\u002Faction identifiers and affected version constraints.\n- Recommendations preserve reproducibility and include validation or scan guidance.\n\n## Output Requirements\n\n- Summarize dependency posture by ecosystem.\n- List findings by severity with manifest\u002Flockfile references.\n- State which scanners or package-manager commands were run or could not be run.\n\n## Changelog\n\n### 1.1.0 - 2026-06-10\n\n- Added production-ready skill-specific operating model, checklist, decision rules, acceptance criteria, and output requirements.\n\n### 1.0.0 - 2025-01-01\n\n- Initial release.\n","# Dependency Supply Chain Reviewer\n\n## Purpose\n\nReview dependencies, lockfiles, package managers, container images, actions, and supply-chain risks.\n\n## When to use\n\nUse this skill when the task matches the description above or when the central agent instructions route work to `$dependency-supply-chain-reviewer`.\n\n## Operating model\n\n1. Clarify the goal and constraints.\n2. Inspect the minimum relevant repository context.\n3. Produce a concise execution plan for non-trivial work.\n4. Execute with tools when implementation is requested.\n5. Validate the result with repository-native checks.\n6. Summarize changed files, validation results, and residual risks.\n\n## DevSecOps guardrails\n\n- Do not read secrets, `.env` files, private keys, production credentials, masked CI\u002FCD variables, database dumps, or sensitive logs unless explicitly required.\n- Do not push, deploy, publish, merge, or create releases unless explicitly asked.\n- Prefer merge requests, reviewable diffs, and auditable validation evidence.\n- Prefer least privilege, minimal changes, and explicit rollback notes.\n- Do not fabricate test results, repository state, commands, or security findings.\n\n## Skill-Specific Operating Model\n\n- Inventory package manifests, lockfiles, vendored code, container bases, CI actions, generators, and release tooling.\n- Prioritize dependencies that execute code during install, build, CI, or production startup.\n- Review version pinning, registry trust, provenance, checksums, update governance, and transitive risk.\n\n## Skill-Specific Checklist\n\n- Manifests and lockfiles are present, consistent, and committed where expected.\n- Third-party actions, images, and tools avoid mutable references or have documented governance.\n- Install scripts, postinstall hooks, generated code, and vendored changes are reviewed as executable supply-chain surface.\n\n## Decision Rules\n\n- Block on dependency sources that can execute unreviewed code in privileged CI or release jobs.\n- Do not recommend blanket upgrades; tie updates to risk, compatibility, or policy.\n- Treat unknown vulnerability status as residual risk, not proof of safety.\n\n## Acceptance Criteria\n\n- Relevant ecosystems and lockfiles are inspected or explicitly marked absent.\n- Findings include dependency\u002Fimage\u002Faction identifiers and affected version constraints.\n- Recommendations preserve reproducibility and include validation or scan guidance.\n\n## Output Requirements\n\n- Summarize dependency posture by ecosystem.\n- List findings by severity with manifest\u002Flockfile references.\n- State which scanners or package-manager commands were run or could not be run.\n\n## Changelog\n\n### 1.1.0 - 2026-06-10\n\n- Added production-ready skill-specific operating model, checklist, decision rules, acceptance criteria, and output requirements.\n\n### 1.0.0 - 2025-01-01\n\n- Initial release.\n",{"name":5,"since":25,"authors":26,"version":28,"replaces":6,"changelog":29,"stability":36,"supersedes":37,"description":7,"last_modified":25,"deprecated_since":6,"min_platform_version":38},"2026-06-10",[27],"platform-engineering","1.1.0",[30,32],{"date":25,"change":31,"version":28},"Added production-ready skill-specific operating model, checklist, decision rules, acceptance criteria, and output requirements",{"date":33,"change":34,"version":35},"2025-01-01","Initial release","1.0.0","stable",[],{"kiro":39,"codex":39,"junie":39,"cursor":39,"ollama":39,"opencode":39,"roo-code":39,"windsurf":39,"openhands":39,"gemini-cli":39,"gitlab-duo":39,"claude-code":39,"github-copilot":39},"unknown","main","850948b1e2e668b3ddfc2ac2959286d4190a8a4a","examples\u002F.agents\u002Fskills\u002Fdependency-supply-chain-reviewer","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr","https:\u002F\u002Fgithub.com\u002Fdomehahn","Proud to live. Love to code and explore. DevSecOps | Cloud & Cloud Native | Java | Go | Python | IaC | AI ","2026-09-11 04:40:53",{"source":8,"skillName":5,"commands":48,"prompt":58,"zipAvailable":59},[49,52,55],{"tool":50,"command":51},"npx","npx skills add domehahn\u002Fskcr --skill dependency-supply-chain-reviewer",{"tool":53,"command":54},"bunx","bunx skills add domehahn\u002Fskcr --skill dependency-supply-chain-reviewer",{"tool":56,"command":57},"pnpm","pnpm dlx skills add domehahn\u002Fskcr --skill dependency-supply-chain-reviewer","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fdependency-supply-chain-reviewer\u002FSKILL.md",true,[61,67,71,75,79,83],{"path":62,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":65,"sourceHtmlUrl":66},"CHANGELOG.md","REFERENCE","参考文档",190,"https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fdependency-supply-chain-reviewer\u002FCHANGELOG.md",{"path":68,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":16},"LICENSE","许可证",214,{"path":72,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":73,"sourceHtmlUrl":74},"README.md",403,"https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fdependency-supply-chain-reviewer\u002FREADME.md",{"path":76,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":77,"sourceHtmlUrl":78},"skill.yaml",416,"https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fdependency-supply-chain-reviewer\u002Fskill.yaml",{"path":80,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":81,"sourceHtmlUrl":82},"tests\u002FREADME.md",108,"https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fdependency-supply-chain-reviewer\u002Ftests\u002FREADME.md",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"VERSION","OTHER","其他",6,"https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002F.agents\u002Fskills\u002Fdependency-supply-chain-reviewer\u002FVERSION",[90,98,106,114,122,130],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":94,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":20},"01M7419KQMCNS14XW21KVG78J3","vulnerability-management-coordinator","Assess CVE triage, prioritization, SLAs, exploitability, asset criticality, exceptions, risk acceptance, and remediation tracking.","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fvulnerability-management-coordinator\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fvulnerability-management-coordinator\u002FSKILL.md",[],[],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":102,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":20},"01M7419GW8E90CEERTQTZ3MTYR","verification-reviewer","Review diffs, validate acceptance criteria, inspect test results, and find missed requirements.","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fverification-reviewer\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fverification-reviewer\u002FSKILL.md",[],[],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":110,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":20},"01M7419CTW726KC0YN9F2E739T","universal-skill-creator","Create, adapt, validate, and optimize reusable agent skills across agentic platforms.","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Funiversal-skill-creator\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Funiversal-skill-creator\u002FSKILL.md",[],[],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":118,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":20},"01M74199GKQYVD5KER7CZ8F2D6","threat-modeler","Identify assets, trust boundaries, abuse cases, attack paths, threats, and required security controls.","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fthreat-modeler\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fthreat-modeler\u002FSKILL.md",[],[],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":126,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":20},"01M74196JRAY93SRVX6X6CDMDF","test-strategy-engineer","Design and generate unit, integration, regression, security, and end-to-end test strategies.","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Ftest-strategy-engineer\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Ftest-strategy-engineer\u002FSKILL.md",[],[],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":134,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":20},"01M74193K4YBY6JHZSVQ92NS9X","sre-reliability-reviewer","Assess SLOs, SLIs, error budgets, capacity, degradation, timeouts, retries, circuit breakers, load shedding, and operational risks.","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fsre-reliability-reviewer\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fdomehahn\u002Fskcr\u002Fblob\u002Fmain\u002Fexamples\u002Fskills\u002Fsre-reliability-reviewer\u002FSKILL.md",[],[]]