# Supply Chain Scan

Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire +...

- Repository: https://github.com/samugit83/redamon (3261 stars)
- Category: Data and ML
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add samugit83/redamon --skill supply-chain-scan -g -a claude-code -y`
Codex: `npx skills add samugit83/redamon --skill supply-chain-scan -g -a codex -y`
Cursor: `npx skills add samugit83/redamon --skill supply-chain-scan -g -a cursor -y`
Gemini CLI: `npx skills add samugit83/redamon --skill supply-chain-scan -g -a gemini-cli -y`

## Description

Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the hardened scanner, and the soft-error markers that record what was never analysed. Trigger: editing scanners/supply_chain_common/, scanners/supply_chain_analyzer/ or scanners/supply_chain_scan/; touching osv_db_sync.py, osv_runner.py, guarddog_runner.py, deep_recovery.py, or the offline OSV database handling.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

## When to Use

- Changing any of the three supply-chain layers (OSV, GuardDog, retire/trufflehog)
  or the offline database plumbing.

The `supply_chain_common`-must-be-bind-mounted rule is in the
[AGENTS.md](../../scanners/supply_chain_scan/AGENTS.md) CRITICAL RULES; this skill is the
scanning behaviour.

---

## Critical Rules

- **NEVER assume the offline OSV database is populated.** It is filled lazily,
  per-ecosystem, only on the explicit `--download-offline-databases` step - NOT on
  every scan and NOT at install time
  ([scanners/supply_chain_common/osv_db_sync.py](../../scanners/supply_chain_common/osv_db_sync.py)).
  A scan against an unsynced ecosystem must report it as missing, not crash.
- **NEVER `chmod` the OSV DB tighter than world-readable.** The scanner runs
  hardened and non-root; `osv_db_sync.py` makes the whole tree
  world-readable/traversable on purpose so the scanner can read it. Restricting it
  breaks offline scans silently.
- **NEVER erase an existing soft-error marker on a failed/invalid analysis.** A
  package the analyzer never actually inspected is recorded as a `soft_error`
  ([scanners/supply_chain_common/deep_recovery.py](../../scanners/supply_chain_common/deep_recovery.py));
  invalid GuardDog output must be dropped, not allowed to overwrite those markers
  (regression fixed in commit `c5cd6a16`).
- **NEVER run the OSV binary without the `--offline` pairing.** Offline mode uses
  the `--offline --download-offline-databases` pair; using one without the other
  either hits the network or reads an empty DB.

---

## Layers

The rest: https://github.com/samugit83/redamon/blob/HEAD/skills/supply-chain-scan/SKILL.md