Supply Chain Scan
Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire +...
Install
npx skills add samugit83/redamon --skill supply-chain-scan -g -a claude-code -y- Repository
- samugit83/redamon3.3k
- Category
- Data and ML
- Updated
- 3d ago
- License
- MIT
- Context cost
- Lightabout 669 tokens
- Runs scripts
- No, instructions only
What it does
Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the hardened scanner, and the soft-error markers that record what was never analysed. Trigger: editing scanners/supply_chain_common/, scanners/supply_chain_analyzer/ or scanners/supply_chain_scan/; touching osv_db_sync.py, osv_runner.py, guarddog_runner.py, deep_recovery.py, or the offline OSV database handling.
When to Use
- Changing any of the three supply-chain layers (OSV, GuardDog, retire/trufflehog) or the offline database plumbing.
The supply_chain_common-must-be-bind-mounted rule is in the
AGENTS.md CRITICAL RULES; this skill is the
scanning behaviour.
Critical Rules
- NEVER assume the offline OSV database is populated. It is filled lazily,
per-ecosystem, only on the explicit
--download-offline-databasesstep - NOT on every scan and NOT at install time (scanners/supply_chain_common/osv_db_sync.py). A scan against an unsynced ecosystem must report it as missing, not crash. - NEVER
chmodthe OSV DB tighter than world-readable. The scanner runs hardened and non-root;osv_db_sync.pymakes the whole tree world-readable/traversable on purpose so the scanner can read it. Restricting it breaks offline scans silently. - NEVER erase an existing soft-error marker on a failed/invalid analysis. A
package the analyzer never actually inspected is recorded as a
soft_error(scanners/supply_chain_common/deep_recovery.py); invalid GuardDog output must be dropped, not allowed to overwrite those markers (regression fixed in commitc5cd6a16). - NEVER run the OSV binary without the
--offlinepairing. Offline mode uses the--offline --download-offline-databasespair; using one without the other either hits the network or reads an empty DB.
