From vanguard-frontier-agentic
Reviews .NET CI/CD and NuGet supply-chain integrity: SDK pinning, package version pinning, lock files, feed trust, secret exposure, and build reproducibility.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:dotnet-supply-chain-reviewThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill reviews .NET CI/CD and NuGet supply-chain integrity — the build pipeline and package configuration that decide whether a malicious, vulnerable, or unexpected dependency can reach a release. A .NET build is only tamper-resistant if the SDK is pinned, package versions are pinned and lock-verified, feeds are trusted and HTTPS, vulnerability scanning runs in CI, secrets never reach fork-...
This skill reviews .NET CI/CD and NuGet supply-chain integrity — the build pipeline and package configuration that decide whether a malicious, vulnerable, or unexpected dependency can reach a release. A .NET build is only tamper-resistant if the SDK is pinned, package versions are pinned and lock-verified, feeds are trusted and HTTPS, vulnerability scanning runs in CI, secrets never reach fork-PR code, and the build is reproducible. The review catches floating versions, missing lock files, untrusted or plain-HTTP feeds, soft-failure escape hatches on the build, secret exposure to pull_request_target and fork PRs, missing vulnerability scans, unpinned SDKs, and absent SBOM or provenance. It complements the generic ci-test-pipeline-review skill, which owns test-gating mechanics; this skill owns the .NET build and NuGet supply chain specifically.
.github/workflows/*.yml, .gitlab-ci.yml, azure-pipelines.yml), a global.json, a Directory.Packages.props, a NuGet.config, a packages.lock.json, a .csproj, or a .pubxml.pull_request_target build job (PR-author code runs with secrets in scope) as a stop-the-line exfiltration path.NuGet.config as a tampering and credential-leak path.continue-on-error: true or || true on the build or test step as a gate that verifies nothing.*, floating 1.2.*) as a non-reproducible build that silently absorbs upstream changes.packages.lock.json and Central Package Management (Directory.Packages.props) as no transitive-dependency pinning.dotnet list package --vulnerable (or equivalent) vulnerability scan in CI as a build that ships known CVEs.global.json as a non-reproducible toolchain.dotnet restore not run with --locked-mode when a lock file exists as a lock file that is decorative..pubxml) that commits secrets as a credential leak.confirmed (config provided), inference (config partial), assumption (config absent), or unknown.Load these only when needed:
Return, at minimum:
global.json)packages.lock.json, Central Package Management, locked-mode restore)NuGet.config source trust, HTTPS)pull_request_target exposure, publish-profile hygiene)npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticProvides software supply chain security guidance on SBOM generation, SLSA framework, dependency scanning, SCA tools, and protections against attacks like dependency confusion and typosquatting.
Audits dependency configs for supply chain risks like unpinned versions, missing lockfiles, postinstall scripts in package.json, requirements.txt, Gemfile, go.mod, Cargo.toml, pom.xml. Hardens with pinning, SBOM, signing best practices.
Runs a 7-phase verification pipeline for .NET projects: build, analyzers, antipatterns, tests, security, formatting, and diff review. Use before PRs or after features/refactors.