supply-chain plugins

by Eric Quintero

Audit a project's npm, PyPI, and Go dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned upstreams, npm publisher concentration, and install scripts

by Jeremy Longshore

24 governed Flexport v3 and MCP operator workflows for freight, trade data, webhooks, and secure integrations

by Mohit Aggarwal

Supply chain & procurement skills: weighted RFP scoring, supplier scorecards, S&OP meeting prep, demand forecast interrogation, inventory policy (ABC/XYZ), and logistics incident reports — buyer and planner judgment.

by Tartiner Labs

Deprecated: install the workflow, quality, security, and tooling plugins instead. Language-agnostic agent skills for git/GitHub workflows, code quality, and project tooling, with first-class JS/TS support.

by Hashgraph Online

Install and manage the local-first HOL Guard package for Claude Code. This plugin guides setup and status checks; HOL Guard itself installs and owns runtime security hooks for risky commands, secrets, packages, MCP, and supply-chain activity.

by Lauri Gates

Code review, refactoring, linting, anti-pattern detection, and static analysis

by Matt Corbett

International freight-forwarding sales team — specialist agents (freight-rate-quoter, rfq-tender-strategist, key-account-manager, pipeline-forecast-coach, prospecting-outreach-strategist, trade-lane-compliance-advisor) for the day-to-day of a global-forwarding sales / business-development manager: building accurate all-in ocean + air quotes (chargeable weight, BAF/CAF/THC/LSS surcharges, margin), responding to RFQs/RFPs/tenders, running QBRs and account plans, keeping the CRM pipeline and forecast honest, prospecting shippers multi-channel, and getting Incoterms 2020 + customs basics right. skills, slash commands, a knowledge bank with Mermaid decision trees (mode, quote-vs-qualify, Incoterms, spot-vs-contract, rate-objection, account-risk, prospect-pursuit, quote-delivery, LCL-vs-FCL, deadline mode-shift), a scenarios bank, and a runnable chargeable-weight / quote-margin calculator. Carrier-neutral — any forwarder or 3PL. Inherits ravenclaude-core protocols.

by Matt Corbett

Open-source maintenance team — agents (oss-maintainer-strategist, release-and-versioning-engineer) for running a public project people can contribute to: license choice (permissive vs copyleft, dependency compatibility, CLA vs DCO), governance & community-health (CONTRIBUTING / CODE_OF_CONDUCT / GOVERNANCE / SECURITY.md, issue & PR triage + SLAs, the contributor funnel, bus factor, funding), semver + changelogs (Keep a Changelog / Conventional Commits), release automation (release-please / semantic-release / Changesets), deprecation windows, coordinated security releases (private report -> CVE/GHSA -> disclosure), and supply-chain provenance (SLSA, Sigstore). skills, a knowledge bank with two Mermaid decision trees + a dated 2026 tooling map, best-practices, templates, an advisory hook. Seams: release pipelines -> devops-cicd; vuln analysis -> security-engineering; community growth -> developer-relations; docs -> technical-writing-docs. Requires ravenclaude-core@>=0.7.0.

by Matt Corbett

Security-engineering (AppSec) team — agents (appsec-engineer, threat-modeler, supply-chain-security-engineer, cloud-security-engineer) for building security INTO software: threat modeling (STRIDE, data-flow diagrams, trust boundaries), application security testing (SAST/DAST/IAST/SCA in CI, OWASP Top 10 web), secrets management (detection, rotation, vaulting, no plaintext), software supply-chain integrity (SBOM consumption, dependency CVEs, SLSA verification, pinning), and cloud security posture (CSPM, IAM least-privilege, network exposure). skills, a decision-tree knowledge bank (vuln-triage + secrets-handling trees + a dated 2026 tooling map), best-practices, templates, commands, an advisory hook. **Proposes controls; every ship/no-ship security VERDICT escalates to ravenclaude-core/security-reviewer.** Seams: API OWASP -> api-engineering, identity -> auth-identity, data privacy -> data-governance-privacy. Requires ravenclaude-core@>=0.7.0.

by Matt Corbett

Supply-chain planning specialists — the plan layer between buy and move: S&OP/IBP cycle orchestration, demand forecasting (statistical + consensus, MAPE/bias, new-product, seasonality), inventory optimization (safety stock, service-level targets, ABC/XYZ, EOQ, multi-echelon, working-capital tradeoff), and MRP/replenishment. Ships agents (supply-chain-planner, demand-planning-analyst, inventory-optimization-engineer, sop-process-lead), skills (demand-forecasting, inventory-policy-and-safety-stock, sop-process), commands, templates, a decision-tree knowledge bank, best-practices, and an advisory anti-pattern hook. Inherits ravenclaude-core protocols.

by Christopher Boone

Pin every version surface in a repository (action SHAs, packageManager integrity digests, dependency exact-pins, runtime version files, install commands) for one-shot supply-chain hardening.

by Christopher Boone

Pin every version surface in a repository (action SHAs, packageManager integrity digests, dependency exact-pins, runtime version files, install commands) for one-shot supply-chain hardening.

by VibeShield

Bug-hunting security audit for AI-generated code. One skill, parallel bug-hunter subagents, findings in the VibeShield contract format.

by Adam Daniel

Adam's general-purpose skills, safe anywhere including cloud sessions: writing voice, GitHub Actions debugging and hardening, ADRs, resolving task ambiguity.

by Adam Daniel

Adam's coding skills for Claude Code terminals and Claude Code cloud sessions: GitHub Actions debugging and hardening, settings-as-code, bash CI reliability review, skill provenance, disarming inherited reach, and filing vendor release-impact issues.

by Hodios contributors

Hodios security entries: prompts, personas and workflows.

by mlab.sh

Analyst-grade threat intelligence workflows on top of the mlab.sh platform: IOC triage, SBOM vulnerability audits, threat actor profiling and phishing/smishing triage.

by Sergey Vasilevskiy

Verifies signatures on the instruction files Claude Code loads, meaning CLAUDE.md, skills, and agent definitions, before they reach model context. It re-checks a skill bundle before the Skill tool runs it. Sigstore keyless, offline verification against a pinned trust root, no telemetry.

by Carlos Araujo

Gate determinístico, estritamente read-only e fail-closed, com risco P1/P2/P3, 12 investigadores e evidência estruturada.