← 返回 Skills 市场
77
总下载
0
收藏
1
当前安装
1
版本数
在 OpenClaw 中安装
/install nm-leyline-supply-chain-advisory
功能描述
Supply chain security patterns for dependency management: known-bad version detection, incident response, lockfile auditing, and artifact scanning
安全使用建议
This skill is coherent with a supply-chain incident-response role and is instruction-only (no install or external downloads). Before using: (1) review any commands that search your home or project directories and restrict paths to only the projects you intend to scan (avoid automated whole-home scans unless needed); (2) be aware that the IR checklist recommends capturing the full environment (env > /tmp/...), which will include secrets — treat those snapshots as highly sensitive, store them securely, and delete when no longer needed; (3) verify where known-bad-versions.json will be stored and who can read/write it; (4) do not run suggested commands as root unless unavoidable; and (5) if you enable autonomous agent invocation, ensure the agent is permitted only to suggest actions (not to execute destructive remediation) unless you fully trust the environment. If you want higher assurance, request or inspect the project's known-bad-versions.json and any team-specific hooks referenced in the metadata before enabling the skill.
能力评估
Purpose & Capability
Name/description (supply-chain advisory for dependency management) align with the provided guidance: lockfile parsing, artifact scanning, blocklist management, and incident-response checklists. The declared config path (night-market.error-patterns) is plausibly a platform config the skill expects; its use is referenced in metadata though not elaborated in the human-facing text (minor mismatch but not a functional red flag).
Instruction Scope
SKILL.md instructs scanning lockfiles, searching home/project trees, and capturing environment snapshots (env > /tmp/...). Those steps fall inside legitimate incident-response workflows but do involve broad filesystem scanning and collection of environment variables (which may include secrets). The instructions do not direct data to external endpoints or request unrelated system modifications.
Install Mechanism
No install spec and no code files to run at install time — the skill is instruction-only, which minimizes install-time risk. The embedded Python snippets are examples for implementers, not executables fetched at install.
Credentials
The skill does not require environment variables or credentials in its manifest, which is proportional. However, the incident-response guidance explicitly captures the full environment for forensics; capturing env is reasonable in IR but is sensitive because it can expose secrets — this is a functional necessity rather than an unjustified request for credentials.
Persistence & Privilege
The skill is not always-on, does not request elevated platform privileges, and does not modify other skills' configs. Agent autonomous invocation is allowed (platform default) but not combined with other concerning flags.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install nm-leyline-supply-chain-advisory - 安装完成后，直接呼叫该 Skill 的名称或使用
/nm-leyline-supply-chain-advisory触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
- Initial release of the supply-chain-advisory skill.
- Provides patterns for detecting, preventing, and responding to compromised Python dependencies.
- Includes support for known-bad version detection, incident response, lockfile auditing, and artifact scanning.
- Offers guidance for configuring blocklists and responding to supply chain advisories.
- Designed for use after supply chain alerts, during audits, and for incident response.
元数据
常见问题
Nm Leyline Supply Chain Advisory 是什么？
Supply chain security patterns for dependency management: known-bad version detection, incident response, lockfile auditing, and artifact scanning. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 77 次。
如何安装 Nm Leyline Supply Chain Advisory？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install nm-leyline-supply-chain-advisory」即可一键安装，无需额外配置。
Nm Leyline Supply Chain Advisory 是免费的吗？
是的，Nm Leyline Supply Chain Advisory 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Nm Leyline Supply Chain Advisory 支持哪些平台？
Nm Leyline Supply Chain Advisory 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Nm Leyline Supply Chain Advisory？
由 athola（@athola）开发并维护，当前版本 v1.0.0。
推荐 Skills