praneethkukunuru/.agents/skills/hephaestus-supply-chain-gate
.agents/skills/hephaestus-supply-chain-gate/SKILL.md
# hephaestus-supply-chain-gate Use this skill for deterministic A03/A08 dependency and integrity gate checks. ## Purpose Enforce supply-chain and artifact-integrity controls before ship. ## Master Directive This skill MUST follow `.hephaestus/prompts/master-agent-directive.md`. This skill MUST follow `.hephaestus/prompts/db-navigation-contract.md`. This skill MUST follow `.hephaestus/prompts/ci-automation-contract.md`. This skill MUST follow `.hephaestus/prompts/security-review-contract.md`
tools
Updated Apr 16, 2026
$ install --global
skillsauthnpx skillsauth add praneethkukunuru/synq-test-103 .agents/skills/hephaestus-supply-chain-gateInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 8:57 PM1.8s1 file scanned
SKILL.md
hephaestus-supply-chain-gate
Use this skill for deterministic A03/A08 dependency and integrity gate checks.
Purpose
Enforce supply-chain and artifact-integrity controls before ship.
Master Directive
This skill MUST follow .hephaestus/prompts/master-agent-directive.md.
This skill MUST follow .hephaestus/prompts/db-navigation-contract.md.
This skill MUST follow .hephaestus/prompts/ci-automation-contract.md.
This skill MUST follow .hephaestus/prompts/security-review-contract.md.
Use When
- Dependency/lockfile/build-artifact surfaces changed.
- Security gate requires supply-chain confirmation.
Inputs
- dependency diffs
- lockfile changes
- CI artifact metadata
- existing security findings
Outputs
security_controlsrows for A03/A08 checkssecurity_gate_decisionsrow- blockers for unresolved material risk
Procedure
- Inspect dependency and integrity deltas.
- Record deterministic control checks and evidence links.
- Persist gate decision with block/conditional/approve.
- Open blocker if unresolved high/critical risk remains.
Guardrails
- No silent acceptance of unsigned or unverifiable dependency changes.
- No bypass of supply-chain gate for release.
- Retry without diagnosis is prohibited.
Handoff
Include:
- Control-by-control status
- Blocking findings and owners
- Required remediation for release
Related Skills
praneethkukunuru/system_architect
content-media
VerifiedTrustedCommunity
Design correctness and implementation drift owner
SKILL.mdUpdated Apr 16, 2026
praneethkukunuru/scrum_master
tools
VerifiedTrustedCommunity
Stage readiness and artifact completeness owner
SKILL.mdUpdated Apr 16, 2026
praneethkukunuru/roadmap_advisor
tools
VerifiedTrustedCommunity
Roadmap Advisor
SKILL.mdUpdated Apr 16, 2026
praneethkukunuru/reviewer
testing
VerifiedTrustedCommunity
Correctness, security, and maintainability owner
SKILL.mdUpdated Apr 16, 2026