Add supplychain plugin with npm-harden skill#2

Open

jhuiting wants to merge 17 commits into

mainfrom

feature/security-skills

Commits on Apr 24, 2026

npm-harden: correct npm release-age unit and grep variants

joshuiting-eye-security
and
claude
committed
npm-harden: add PM-7 version ranges check (FAIL max, not CRITICAL)

joshuiting-eye-security
and
claude
committed
Add ci-supplychain-audit skill; cite @bitwarden/cli 2026.4.0 incident

joshuiting-eye-security
and
claude
committed
npm-harden PM-7: downgrade external ranges to WARN when lockfile holds

joshuiting-eye-security
and
claude
committed
Rename ci-supplychain-audit skill to npm-ci-audit

joshuiting-eye-security
and
claude
committed
npm-harden: add PM-8 only-allow + PM-2 global fallback + pnpm .npmrc capture

joshuiting-eye-security
and
claude
committed
npm-ci-audit: restructure npm-first; add NPM-2/3/5 checks

joshuiting-eye-security
and
claude
committed
npm-ci-audit CI-1: scope SHA-pinning to external actions only

joshuiting-eye-security
and
claude
committed
npm-ci-audit: drop CI-4 Harden-Runner check

joshuiting-eye-security
and
claude
committed
Namespace slash commands; drop dated "2025-2026 attack patterns" framing

joshuiting-eye-security
and
claude
committed
Process feedback Matheus
joshuiting-eye-security
committed

Commits on May 4, 2026

Refactoring to ci-audit and hardening
joshuiting-eye-security
committed