ultrasafe-supply-chain-auditor
SolidPre-release simulated penetration testing from the dependency / SBOM / typosquatting / signing-chain perspective. Invoke as Agent 3 of the Ultrasafe 8-agent fan-out (Ultrasafe.md §15.3) whenever the iteration axis-set includes `usf-supply-chain`, or whenever a release candidate touches dependency manifests (package.json / pyproject.toml / Cargo.toml / go.mod / requirements*.txt / lockfiles / SBOM artifacts / signed-attestation chains). Emits `ULTRASAFE_FINDING` A2A intents (Constellation §13.16, §18.1) with PURL canonical ids, OSV CVE matches, SLSA provenance verdicts, cosign+Rekor attestation chain status, and maintainer-anomaly flags. v0.2.x = advisory mode (report-only, never auto-blocks publish); v0.3+ = blocking gate for deterministic signals only. Maintainer-anomaly findings are always human-gated (Ultrasafe §2.1.3 CT1) regardless of mode.
Install
Quality Score: 81/100
Skill Content
Details
- Author
- SoliEstre
- Repository
- SoliEstre/EstreGenesis
- Created
- 2 months ago
- Last Updated
- today
- Language
- JavaScript
- License
- Apache-2.0
Integrates with
Similar Skills
Semantically similar based on skill content — not just same category
ultrasafe-web-api-attacker
Pre-release simulated penetration testing from the OWASP Top 10 / API contract / auth-bypass / SQLi / XSS / SSRF / CSRF / open-redirect / IDOR attacker perspective. Invoke during Ultrasafe ≥3-iteration fan-out when the axis-set includes `usf-web-sast-dast` or `usf-web-infra`, or when a PreToolUse trigger matches a publish-equivalent command (npm publish / pip upload / git push --tags public). Emits `ULTRASAFE_FINDING` A2A intent per finding (Constellation §13.16) with OSCAL-aligned payload + attack-path-graph flat-list candidate. v0.2.x advisory mode — report-only, no publish blocking; blocking promotion deferred to v0.3+.
ultrasafe-threat-model-lifecycle
Pre-release simulated penetration testing from the threat modeling (STRIDE/PASTA) + incident lifecycle + disclosure timing attacker perspective. Invoke as one of 8 attackers in Ultrasafe fan-out runtime when a publish-equivalent action (npm publish / pip upload / git push --tags to public / release-gate trigger) is approaching, OR when orchestrator dispatches ULTRASAFE_RUN_FANOUT with role=threat-model-lifecycle, OR when SECURITY_DISCLOSURE_INTAKE/MPCVD_COORDINATION inbound requires lifecycle-timing review. Emits ULTRASAFE_FINDING via Constellation §13.16 (advisory mode in v0.2.x — report-only, no publish blocking). Output tone is lifecycle-systematic — every finding traces to a named threat-model element (STRIDE letter or PASTA stage) and an incident-lifecycle phase (prepare/detect/contain/eradicate/recover/lessons).
ultrasafe-crypto-reviewer
Pre-release simulated penetration testing from the cryptography attacker perspective — key management / random source / TLS misuse / signature scheme / constant-time violation / PQC readiness / cryptographic agility envelope. Triggered by Ultrasafe orchestrator (`ultrasafe_run_fanout` MCP tool) when the axis-set includes `usf-crypto`, or by the PreToolUse `ultrasafe-trigger.cjs` hook on publish-equivalent commands (npm publish / pip upload / git push --tags to public). Emits findings via the `ULTRASAFE_FINDING` A2A intent (Constellation §13.16.9), conforming to the Ultrasafe.md §4 finding output contract with the `perspective.primary = "crypto-reviewer"` variant. Advisory mode in v0.2.x (report-only, no publish block); blocking mode deferred to v0.3+.