supply-chain-advisoryv1.9.17

When a new advisory for a compromised Python package is published, use this skill to check lockfiles and installed packages for known-bad versions, quickly verifying if your projects are affected.

Integrate the lockfile scanning and artifact detection commands into your CI pipeline to automatically flag compromised dependencies before deployment, reducing the risk of supply chain attacks.

During a security incident where a dependency may have been tampered with, use the skill to search for malicious artifacts, check hashes, and identify affected versions across all projects.

When starting a new Python project, apply version exclusions and configure the SessionStart hook to ensure that known-bad versions are blocked from the outset.

Schedule regular scans of uv.lock files across repositories to verify hash integrity and catch any tampered re-published packages, maintaining a strong defense layer.

Offer a cloud-based service that continuously monitors customer repositories for known-bad dependencies, using the skill's patterns for automated scanning and alerting.

Provide expert consulting to help organizations implement supply chain security practices, including lockfile auditing and response playbooks based on this skill.

Package the skill as an open-source CLI tool with optional paid support, custom integrations, and advanced reporting for enterprise clients.