moai-ref-supply-chain

moai-ref-supply-chain is an Application security skill for AI agents, published by modu-ai in the moai-adk repository on GitHub. Skillspace rates moai-ref-supply-chain F (45/100) and the safety scan rated it risky; the rating is based on static analysis only.

Risky. This skill has patterns associated with unsafe behaviour. Read the source carefully before running it.

Software supply-chain defensive security reference: SBOM generation and verification (SPDX / CycloneDX), dependency-confusion defense, malicious-package triage playbook, SLSA provenance levels, Sigstore / cosign signing and verification, package-registry hardening, typosquatting defense, and transitive-dependency auditing. Agent-extending skill that amplifies backend, security, and release-engineering work with production-grade defensive patterns for the software supply chain. NOT for: offensive techniques (dependency-confusion attack execution, malicious package authoring, registry exploitation), LLM/AI-specific security (see moai-ref-llm-security), web-app OWASP Top 10 (see moai-ref-owasp-checklist), or general API design (see moai-ref-api-patterns).

Grade

F

Quality

45 / 100

Safety

Risky

GitHub stars

1,212

Unproven: rated by static analysis only, not yet compared head-to-head.

Our two independent classifiers differ on this skill's category, so treat the placement as provisional.

This rating describes the version of the repository we crawled; it may have changed since.

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.