NVIDIA / SkillSpector
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
graygnatconsole / mcp-audit-tool
🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure Python, SARIF + CI ready.
nolabs-ai / nono
agent runtime security - zero trust, zero setup, zero latency agent sandboxing
threathunterX / underground-slang-lexicon
A continuously updated lexicon of underground slang in the online fraud and gray-market economy: definitions, supply-chain roles, sanitized real-world usage and false-positive warnings. Chinese-dominant, with Brazilian Portuguese, English, Indonesian, Tagalog and Vietnamese entries. Maintained by the Threat Hunter research team.
MaxHu-xuan / artifactproof
Verify that the PowerPoint you are about to deliver is exactly the PPTX that passed QA—locally, offline, and with tamper-evident evidence.
fleetbase / fleetbase
Modular logistics and supply chain operating system (LSOS)
step-security / harden-runner
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
hashgraph-online / hol-guard
Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.
muxuuu / serenity-skill
Serenity-inspired Agent Skill for supply-chain bottleneck stock research
boostsecurityio / poutine
poutine, a supply chain vulnerability scanner for build pipelines
Noob-stupid / dsh-plugin-gating-hub
DSH plugin - framework upgrade safety & plugin gating: contract pre-check, rollback point, auto-rollback on failure, evidence-based auto-disable; plus a multi-source plugin market. Unofficial. | DSH 插件：框架升级安全 + 插件门控——升级前契约预检、回滚点、失败自动回滚、有确证证据才自动禁用；另带多源插件市场。非官方社区项目。
perplexityai / bumblebee
Read-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software supply-chain compromises.
sheeki03 / tirith
Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.
slsa-framework / slsa
Supply-chain Levels for Software Artifacts
lirantal / npq
safely install npm packages by auditing them pre-install stage
guacsec / guac
GUAC aggregates software security metadata into a high fidelity graph database.
pypa / pip-audit
Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
ossf / best-practices-badge
🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)
owasp-dep-scan / dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
thieu1995 / mealpy
A Collection Of The State-of-the-art Metaheuristic Algorithms In Python (Metaheuristic/Optimizer/Nature-inspired/Biology)
DataDog / guarddog
:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages
sigstore / rekor
Software Supply Chain Transparency Log
safedep / vet
Protect against malicious open source packages 🤖
cdxgen / cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
endojs / endo
Endo is a distributed secure JavaScript sandbox, based on SES
mozilla / cargo-vet
supply-chain security for Rust
openpubkey / openpubkey
Reference implementation of OpenPubkey
toby-bridges / api-relay-audit
Local security audit for AI API relays and LLM proxies: detects prompt injection, model substitution, tool-call rewriting, SSE anomalies, error leakage, and Web3 wallet risks.
asamassekou10 / ship-safe
The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.
theupdateframework / go-tuf
Go implementation of The Update Framework (TUF)
chainloop-dev / chainloop
Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.
CycloneDX / specification
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX
safedep / pmg
PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.
in-toto / witness
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
sigstore / sigstore
Common go library shared across sigstore services and clients
elastic / supply-chain-monitor
—
Hoylon / peerbridge-mcp
Local-first, auditable multi-agent control room for coding, review, evidence, and private remote work.
liyuqin606-del / packrehearsal
Turn npm, Python, and Rust release evidence into bounded Codex maintenance tasks.
NocodeMrLi / mini-program-engineering-skill-suite
Mini Program Engineering Skill Suite is an Agent Skill suite for evidence‑first mini‑program development. It helps agents bring WeChat or other mini‑program projects from vague intent to reliable engineering work: project intake, product specification, architecture, implementation, UI & device adaptation, debugging, verification, release readiness.
ciceroyang / agentgate
Control plane for the tools agents run: inventory, evidence, policy, enforcement. Clean is only emitted when every check ran. · agent 工具层的控制面：清单、证据、策略、执行；只有每个检查都跑完，才会给出 clean。
Yutong0711 / PARAPET
Turn a security or performance exposure into a reviewable decision
limingrui679-design / CascadeLens
Python-first systemic-risk research software for evidence-graded, bitemporal dependency graphs. Import JSON, CSV, GraphML, or NetworkX; run bounded shocks, compare constrained interventions and sensitivity surfaces, and export recomputation-verifiable RiskPacks. Includes 16 scenario-only cases and 11 connector contracts.
typesafe-docs / action-dist-verify
Rebuild the JavaScript GitHub Actions your workflows pin and check that their committed dist matches the source.
diyanbogdanov / emend
Verified AI dependency migrations. Finds which of your lines a version bump actually breaks, fixes them, and proves the result still compiles and passes your tests.
nithin42 / Azure-ai-foundry-erp-swarm
Autonomous SAP S/4HANA & ServiceNow Supply Chain Multi-Agent Swarm on Azure AI Foundry with Two-Phase Commit Safety
stephanww / rn-dev-security-guide
The React Native Developer's Security Guide: A field guide to supply-chain and toolchain security for React Native developers - securing your workstation, dependencies and CI.
starslingdev / skills
Agent skills from StarSling
luantak / is-malicious
A codebase scanner that helps you not run malicous code
AyaanB-DotCom / android-tv-supply-chain-malware
Hardware-level firmware extraction and malware analysis of a $25 Android TV box
ZSeven-W / dsh-harbor
DeepSeek Harness (DSH) plugin: a read-only ledger for the plugins you already have installed — a capability inventory with file:line evidence, declared-vs-detected reconciliation, cross-profile version drift, and a diff of what changed since the last scan.