Supply Chain Guard

What you get

Point Skill Supply-Chain Guard at a skill package, a plugin manifest, or an MCP server config, and get one trust score and one verdict before anything installs. The audit reads the whole package tree as data. It never executes what it reads, and nothing the package says is ever treated as an instruction to the auditor.

Every finding comes back with a stable key, a severity, a confidence, the exact file span, and a remediation pattern you can hand to the author.

What it catches

24 threat IDs across 8 families:

• Hidden or conflicting instructions
• Exfiltration paths
• Over-broad tool permissions
• Secrets
• Obfuscation
• Install-time execution
• Undocumented network calls
• Rug-pull risk

The differentiator is cross-file contradiction. A package can ship a clean entry point and put the payload in a reference file, a changelog, or an example. This tool reads across files, fixes the precedence order, and tells a contradiction apart from a restatement, a paraphrase, an elaboration, or an addition. A single-file scanner cannot do that by construction.

The number

99.7% pooled per-assertion pass rate, with-skill (1159/1163), at auditor@1.0 / corpus@1.0.0 / config@cfg-4f9a1c7f.

That figure is contract-derived, not measured: the with-skill side follows from the frozen contract and the without-skill side is modeled, and no model was executed. Treat it as evidence that the contract is internally consistent, not as a field result.

What it is not

• No live runtime monitoring.
• No network interception.
• No dependency CVE scanning.
• No binary reverse engineering.
• No H2 detection: a trigger cannot be bound to its effect without running the package, so H2 is reported but unscored in v1.0.

Fine print

This skill makes no network calls at audit time and executes nothing. external_urls is declared as an explicit empty list.

The bundle contains descriptions of the patterns it detects, including the taxonomy's own example signals and the auditor-address definition in scope.md. These are the tool's vocabulary, stated in the frozen contract. self-scan.md records the target set, the declared-specification policy, and the two hits by file.

Four known defects ship in v1.0, each with a backlog item: one package is not fully deterministic on the false-positive guard (BL-01); one package reported a category clean where it could not be checked (BL-02); E3 is claimed by the taxonomy and unexercised by the corpus (BL-03); and one internal expectation describes two incompatible states for H2 (BL-04). Known limits L-1 through L-6 are listed in full in the README.