Skip to main content

supply-chain-audit

Conducts multi-language supply chain audits to detect dependency poisoning and enhance security against supply chain attacks.

Install this skill

or
0/100

Security score

The supply-chain-audit skill was audited on May 12, 2026 and we found 71 security issues across 6 threat categories, including 33 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

high line 37

Direct command execution function call

SourceSKILL.md
37(r'import\s+.*exec\s*\(', 'import + exec(): 动态代码执行'),
high line 887

Direct command execution function call

SourceSKILL.md
887(r'\bexec\s*\(', 'HIGH', 'exec(): 动态代码执行'),
high line 38

Eval function call - arbitrary code execution

SourceSKILL.md
38(r'import\s+.*eval\s*\(', 'import + eval(): 动态表达式求值'),
high line 231

Eval function call - arbitrary code execution

SourceSKILL.md
231(r'eval\s*\(\s*Buffer\.from\s*\(', 'eval(Buffer.from(...)): 编码混淆+执行'),
high line 232

Eval function call - arbitrary code execution

SourceSKILL.md
232(r'eval\s*\(\s*atob\s*\(', 'eval(atob(...)): base64解码+执行'),
high line 233

Eval function call - arbitrary code execution

SourceSKILL.md
233(r'eval\s*\(\s*require\s*\(', 'eval(require(...)): 动态加载+执行'),
high line 249

Eval function call - arbitrary code execution

SourceSKILL.md
249(r'eval\s*\(', 'eval(): 动态代码执行'),
high line 654

Eval function call - arbitrary code execution

SourceSKILL.md
654(r'eval\s*\(\s*Base64\.decode64', 'eval(Base64.decode64(...)): 解码执行'),
high line 886

Eval function call - arbitrary code execution

SourceSKILL.md
886(r'\beval\s*\(', 'HIGH', 'eval(): 动态代码执行'),
high line 924

Eval function call - arbitrary code execution

SourceSKILL.md
924(r'eval\s*\(\s*Buffer\.from\s*\(', 'CRITICAL', 'eval(Buffer.from(...)): 编码混淆+执行'),
high line 925

Eval function call - arbitrary code execution

SourceSKILL.md
925(r'eval\s*\(\s*atob\s*\(', 'CRITICAL', 'eval(atob(...)): base64+执行'),
high line 300

Piping content to bash shell

SourceSKILL.md
300if any(kw in cmd.lower() for kw in ['curl ','wget ','http://','https://','eval ','base64','powershell','/dev/tcp','|sh','| sh','|bash','| bash']):
high line 462

Piping content to bash shell

SourceSKILL.md
462(r'//go:generate\s+(?:curl|wget|sh|bash|python)', '//go:generate 执行危险命令'),
high line 570

Piping content to bash shell

SourceSKILL.md
570(r'Command::new\s*\(\s*["\'](?:curl|wget|bash|sh|powershell)', 'build.rs 执行危险命令'),
high line 651

Piping content to bash shell

SourceSKILL.md
651(r'system\s*\(\s*["\'](?:curl|wget|bash|sh|powershell)', 'system() 执行危险命令'),
high line 652

Piping content to bash shell

SourceSKILL.md
652(r'`(?:curl|wget|bash|sh).*`', '反引号执行危险命令'),
high line 653

Piping content to bash shell

SourceSKILL.md
653(r'IO\.popen.*(?:curl|wget|sh|bash)', 'IO.popen 执行危险命令'),
high line 907

Piping content to bash shell

SourceSKILL.md
907(r'`[^`]*(?:curl|wget|bash|sh)[^`]*`', 'CRITICAL', '反引号执行危险命令'),
high line 239

Piping content to sh shell

SourceSKILL.md
239(r'spawn\s*\(\s*[\'"](?:bash|sh|cmd|powershell)', 'spawn shell: 启动shell进程'),
high line 300

Piping content to sh shell

SourceSKILL.md
300if any(kw in cmd.lower() for kw in ['curl ','wget ','http://','https://','eval ','base64','powershell','/dev/tcp','|sh','| sh','|bash','| bash']):
high line 462

Piping content to sh shell

SourceSKILL.md
462(r'//go:generate\s+(?:curl|wget|sh|bash|python)', '//go:generate 执行危险命令'),
high line 570

Piping content to sh shell

SourceSKILL.md
570(r'Command::new\s*\(\s*["\'](?:curl|wget|bash|sh|powershell)', 'build.rs 执行危险命令'),
high line 651

Piping content to sh shell

SourceSKILL.md
651(r'system\s*\(\s*["\'](?:curl|wget|bash|sh|powershell)', 'system() 执行危险命令'),
high line 652

Piping content to sh shell

SourceSKILL.md
652(r'`(?:curl|wget|bash|sh).*`', '反引号执行危险命令'),
high line 653

Piping content to sh shell

SourceSKILL.md
653(r'IO\.popen.*(?:curl|wget|sh|bash)', 'IO.popen 执行危险命令'),
high line 881

Piping content to sh shell

SourceSKILL.md
881(r'curl\s+.*\|\s*(?:bash|sh|zsh|python|perl|ruby)', 'CRITICAL', 'curl pipe to shell: 下载并执行远程脚本'),
high line 882

Piping content to sh shell

SourceSKILL.md
882(r'wget\s+.*\|\s*(?:bash|sh|zsh|python|perl|ruby)', 'CRITICAL', 'wget pipe to shell: 下载并执行远程脚本'),
high line 883

Piping content to sh shell

SourceSKILL.md
883(r'base64\s+(?:-D|--decode)\s*\|\s*(?:bash|sh|zsh)', 'CRITICAL', 'base64 decode pipe to shell: 混淆后门'),
high line 884

Piping content to sh shell

SourceSKILL.md
884(r'\|\s*base64\s+(?:-D|--decode)\s*\|\s*(?:bash|sh|zsh)', 'CRITICAL', 'piped base64 decode+execute'),
high line 907

Piping content to sh shell

SourceSKILL.md
907(r'`[^`]*(?:curl|wget|bash|sh)[^`]*`', 'CRITICAL', '反引号执行危险命令'),
medium line 651

System command execution

SourceSKILL.md
651(r'system\s*\(\s*["\'](?:curl|wget|bash|sh|powershell)', 'system() 执行危险命令'),
medium line 890

System command execution

SourceSKILL.md
890(r'os\.system\s*\(', 'HIGH', 'os.system(): 不安全的命令执行'),
medium line 906

System command execution

SourceSKILL.md
906(r'system\s*\(\s*["\']', 'HIGH', 'system(): 命令执行'),
low line 236

Node child_process module reference

SourceSKILL.md
236(r'child_process.*exec\s*\(', 'child_process.exec: 执行系统命令'),
low line 237

Node child_process module reference

SourceSKILL.md
237(r'require\s*\(\s*[\'"]child_process[\'"]\s*\)', 'require child_process: 导入命令执行模块'),
low line 897

Node child_process module reference

SourceSKILL.md
897(r'require\s*\(\s*[\'"]child_process[\'"]\s*\)', 'HIGH', 'require child_process'),
low line 898

Node child_process module reference

SourceSKILL.md
898(r'child_process.*exec\s*\(', 'HIGH', 'child_process.exec: 命令执行'),
medium line 890

Python os.system command execution

SourceSKILL.md
890(r'os\.system\s*\(', 'HIGH', 'os.system(): 不安全的命令执行'),
medium line 300

Curl to non-GitHub URL

SourceSKILL.md
300if any(kw in cmd.lower() for kw in ['curl ','wget ','http://','https://','eval ','base64','powershell','/dev/tcp','|sh','| sh','|bash','| bash']):
medium line 300

Wget to non-GitHub URL

SourceSKILL.md
300if any(kw in cmd.lower() for kw in ['curl ','wget ','http://','https://','eval ','base64','powershell','/dev/tcp','|sh','| sh','|bash','| bash']):
high line 1003

Access to /etc/passwd

SourceSKILL.md
1003(r'/etc/passwd|/etc/shadow', 'CRITICAL', '密码文件访问'),
high line 1003

Access to /etc/shadow

SourceSKILL.md
1003(r'/etc/passwd|/etc/shadow', 'CRITICAL', '密码文件访问'),
low line 95

Access to hidden dotfiles in home directory

SourceSKILL.md
95pyenv_root = os.environ.get('PYENV_ROOT', os.path.expanduser('~/.pyenv'))
low line 194

Access to hidden dotfiles in home directory

SourceSKILL.md
194rdir = os.path.expanduser('~/.claude/audit-reports')
low line 268

Access to hidden dotfiles in home directory

SourceSKILL.md
268os.path.expanduser('~/.npm-global/lib/node_modules'),
low line 271

Access to hidden dotfiles in home directory

SourceSKILL.md
271os.path.expanduser('~/.nvm/versions/node'),
low line 424

Access to hidden dotfiles in home directory

SourceSKILL.md
424rdir = os.path.expanduser('~/.claude/audit-reports')
low line 590

Access to hidden dotfiles in home directory

SourceSKILL.md
590cargo_home = os.environ.get('CARGO_HOME', os.path.expanduser('~/.cargo'))
low line 668

Access to hidden dotfiles in home directory

SourceSKILL.md
668os.path.expanduser('~/.gem/ruby'), os.path.expanduser('~/.rbenv/versions'),
low line 1194

Access to hidden dotfiles in home directory

SourceSKILL.md
1194rdir = os.path.expanduser('~/.claude/audit-reports')
low line 1241

Access to hidden dotfiles in home directory

SourceSKILL.md
1241Reports saved to ~/.claude/audit-reports/
medium line 1256

Access to hidden dotfiles in home directory

SourceSKILL.md
1256- JSON 报告保存在 `~/.claude/audit-reports/supply-chain-{ecosystem}-{timestamp}.json`
high line 965

Access to AWS credentials directory

SourceSKILL.md
965(r'open\s*\([^)]*[\'"].*(?:\.aws/credentials|\.aws/config)[\'"]', 'CRITICAL', '读取AWS凭证'),
low line 92

Access to .env file

SourceSKILL.md
92for venv_name in ('.venv', 'venv', 'env', '.env'):
low line 240

Access to .env file

SourceSKILL.md
240(r'\.readFileSync\s*\(.*(?:\.ssh|\.aws|\.npmrc|\.env|credentials)', '读取敏感凭证文件'),
low line 241

Access to .env file

SourceSKILL.md
241(r'process\.env\b.*(?:KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)', '读取敏感环境变量'),
low line 573

Access to .env file

SourceSKILL.md
573(r'fs::read_to_string.*(?:\.ssh|\.aws|credential|\.env)', 'build.rs 读取凭证文件'),
low line 972

Access to .env file

SourceSKILL.md
972(r'open\s*\([^)]*[\'"].*\.env[\'"]', 'HIGH', '读取.env文件'),
low line 981

Access to .env file

SourceSKILL.md
981(r'\.readFileSync\s*\(.*(?:\.ssh|\.aws|\.npmrc|\.env|credentials)', 'CRITICAL', 'readFileSync读取凭证'),
low line 982

Access to .env file

SourceSKILL.md
982(r'process\.env\b.*(?:KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)', 'HIGH', 'process.env读取敏感变量'),
medium line 962

Access to system keychain/keyring

SourceSKILL.md
962(r'keyring\.get_password\s*\(', 'MEDIUM', '系统密钥链访问'),
low line 39

Base64 decode operation

SourceSKILL.md
39(r'import\s+.*\bbase64\b.*decode', 'import + base64 decode: 编码混淆载荷'),
low line 654

Base64 decode operation

SourceSKILL.md
654(r'eval\s*\(\s*Base64\.decode64', 'eval(Base64.decode64(...)): 解码执行'),
low line 847

Base64 decode operation

SourceSKILL.md
847if re.search(r'eval\s*\(|base64_decode|exec\s*\(|system\s*\(|passthru|shell_exec|curl_exec', content):
low line 883

Base64 decode operation

SourceSKILL.md
883(r'base64\s+(?:-D|--decode)\s*\|\s*(?:bash|sh|zsh)', 'CRITICAL', 'base64 decode pipe to shell: 混淆后门'),
low line 884

Base64 decode operation

SourceSKILL.md
884(r'\|\s*base64\s+(?:-D|--decode)\s*\|\s*(?:bash|sh|zsh)', 'CRITICAL', 'piped base64 decode+execute'),
low line 915

Base64 decode operation

SourceSKILL.md
915(r'base64\.(?:b64decode|decodebytes)\s*\(', 'MEDIUM', 'base64解码（可能的混淆）'),
low line 1036

Base64 decode operation

SourceSKILL.md
1036decoded = base64.b64decode(m.group(0)).decode('utf-8', errors='ignore')
low line 232

Base64 decode via atob()

SourceSKILL.md
232(r'eval\s*\(\s*atob\s*\(', 'eval(atob(...)): base64解码+执行'),
low line 925

Base64 decode via atob()

SourceSKILL.md
925(r'eval\s*\(\s*atob\s*\(', 'CRITICAL', 'eval(atob(...)): base64+执行'),
low line 571

External URL reference

SourceSKILL.md
571(r'Command::new.*\.arg.*(?:http://|https://)', 'build.rs 下载远程内容'),
Scanned on May 12, 2026
View Security Dashboard
Installation guide →
GitHub Stars 325
Rate this skill
Categorydevelopment
UpdatedMay 13, 2026
openclawbackendsecurity-engineerdevops-srebackend-developerdevelopment
xwtro0tk1t-cloud/harness