10 entries

Claude resources tagged “supply-chain”

Every source-backed Claude Code resource tagged supply-chain in the HeyClaude directory — across MCP servers, agents, skills, hooks, commands, and more.

commands

/dependency-risk-review - Dependency Risk Review Command for Claude Code

Rank dependency supply-chain risk from OpenSSF Scorecard health signals and OSV advisories, with actions.

Invocation:/dependency-risk-review [package]

Review firstSource-backedReview firstAdded 9d ago

Safety ✓ Privacy ✓

rules

Dependency Update Review Rules

Review dependency updates with changelog evidence, lockfile checks, vulnerability triage, compatibility tests, and supply-chain risk notes.

Review firstSource-backedReview firstAdded 9d ago

Safety ✓ Privacy ✓

agents

Dependency Update Triage Agent

Triage dependency update PRs with release evidence, lockfile review, advisories, Scorecard signals, tests, and merge recommendations.

Review firstSource-backedReview firstAdded 8d ago

Safety ✓ Privacy ✓

skills

GitHub Artifact Attestation Provenance Capability Pack Skill

Review GitHub artifact attestations, workflow provenance, digests, and release evidence.

Level:expertType:capability-packVerified:validated

Review firstSource-backedReview firstAdded 8d ago

Safety ✓ Privacy ✓

hooks

Lockfile Provenance Checker - Claude Code Hook

Flag npm lockfile entries resolved outside the public registry or missing an integrity hash.

Trigger:PostToolUse

Review firstSource-backedReview firstAdded 9d ago

Safety ✓ Privacy ✓

hooks

ORT Dependency License Checker - Claude Code Hook

Warn on dependency manifest changes and optionally run ORT license analysis before dependency-license drift reaches a PR.

Trigger:PostToolUse

Review firstSource-backedReview firstAdded 9d ago

Safety ✓ Privacy ✓

hooks

Package Download Checksum Guard - Claude Code Hook

Block package and archive downloads unless the proposed Bash command includes sha256sum, shasum, Cosign, GPG, or Minisign verification.

Trigger:PreToolUse

Review firstSource-backedReview firstAdded 8d ago

Safety ✓ Privacy ✓

collections

Secure Claude Code Workstation

Defense-in-depth bundle of secret, dependency, audit, and MCP hardening entries for an agentic Claude Code setup.

Bundle:10 items

Review firstSource-backedReview firstAdded 9d ago

Safety ✓ Privacy ✓

skills

SLSA Provenance Review Capability Pack Skill

Review source and artifact provenance with SLSA expectations, revision checks, builder checks, and risk-aware intake decisions.

Level:expertType:capability-packVerified:validated

Review firstSource-backedReview firstAdded 10d ago

Safety ✓ Privacy ✓

mcp

Socket MCP Server for Claude

Security analysis and vulnerability scanning for dependencies

TrustedFirst-partyLow riskAdded 9mo ago

Safety ✓ Privacy ✓

More resources, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.