supply-chain
Detects supply-chain risks in dependency manifests, lockfiles, install commands, and CI pipelines — missing lockfiles, absent vulnerability scanners, unverified installs, install hooks that pipe remote content to a shell, and AI-hallucinated package names. Use when writing package install commands, dependency manifests, CI/CD configs, build scripts, or code that loads external packages.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/supply-chain" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/supply-chain ~/.claude/skills/supply-chainFrom README
Supply Chain Security Check (A03:2025) What this checks Most exploited supply-chain incidents come from not updating fast enough (sitting on known-CVE versions) and from unverified installs (curl-to-shell, typosquats, hooks). Aggressive exact-pinning is no longer the right default — it traps you on vulnerable releases. Lockfiles + scanners + auto-merge of patches is.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...