📦 Package Supply-Chain Sentinel

Review dependency clues before installation

Package Supply-Chain Sentinel combines a local Python text-pattern scanner with checklists for manual package-name, reputation and lockfile-change review. Automated findings are review clues, not confirmed malicious behavior.

What you get

An agent-loaded SKILL.md workflow with a Python scanner, references, fixtures and tests. Your connected host must retrieve the supporting files and execute Python; Agensi is not the Python runtime. Four rules check lifecycle-script mentions, non-registry source references, download commands, and floating-version or package-management clues. It is not a hosted app or a vulnerability database.

Requirements and version

Package v1.1.2 requires Python 3.10+ with the standard library and an agent host capable of retrieving supporting files and running Python. A local installation is needed only if your chosen host does not provide that runtime. For a separately obtained download, extract the complete folder. Start with the included fixture. An AI-agent subscription or setup service is not included.

Reports and limits

Reports omit source excerpts and matched values. Missing, unreadable or incomplete inputs return CANNOT_ASSESS. Files over 5 MiB are not scanned. Additional matches beyond 500 findings stop scanning with a finding_limit notice. Use only stable, reviewed non-secret snapshots. Filenames can still be sensitive; inspect reports before sharing. This is not a race-resistant sandbox or a total runtime guarantee.

Separate manual review

Package-name/typosquatting and lockfile-change checks require manual evidence review. The scanner does not authenticate registry hashes, verify Git provenance, query CVE or reputation services, install packages, execute lifecycle hooks or prove a dependency safe. Absence of findings is not proof of safety or complete coverage.