Best fit
A maintainer wants a local review queue before installing dependencies, with separate manual package-name and lockfile checks.
// security
Package Supply-Chain Sentinel
Review local dependency manifests for lifecycle-script, source-URL, download-command and version-management clues before installation.
Format: Agent skill, not a hosted app. Agensi provides agent-connected access; the separate Gumroad offer provides a download.
Package requirements: Python 3.10+ and an agent host that can retrieve the supporting files and execute local Python. Agensi provides agent-connected access; extract the complete folder only for a separately obtained downloadable package. An AI-agent subscription or setup service is not included.
You get: Python scanner, review references, fixtures and tests.
Choose your version: Agensi: package v1.1.2 (platform release v1.3). Gumroad download: v1.1.2. Checked October 22, 2026. Get v1.1.2 on Gumroad for $19 USD. Review checkout for taxes or conversion.
Licence and purchase details
Review the package licence and seller terms at checkout.
Agensi access: In a creator test on October 17, 2026, Claude retrieved this package’s helper and required supporting files through Agensi and executed synthetic cases in its local Python sandbox. This was not Agensi-hosted execution, a complete package test, or a guarantee for other hosts. Local setup examples below apply to the separate downloadable package.
Try the included fixture first
For the separately obtained downloadable package, extract the complete folder and open a terminal there. Run the included v1.1.0 fixture:
python scripts/scan_package_supply_chain_sentinel.py --format json fixtures/risky-sample.jsonReview the heuristic findings. They are text-pattern clues, not a malware verdict. Use the references for separate manual package-name, reputation and lockfile-change checks.
Understand the result
In v1.1.0, REVIEW means matches need inspection; CANNOT_ASSESS means coverage is incomplete. NO_HEURISTIC_FINDINGS does not prove safety. Reports omit source excerpts and matched values, retain at most 500 findings, and reject individual files over 5 MiB. Additional matches produce an explicit finding_limit notice.
Stable, reviewed non-secret local text snapshots. Review reports before sharing; filenames can be sensitive. No package installation or lifecycle-hook execution. Other secret-bearing files are not automatically identified. Use the current package and review coverage warnings before acting on findings.
Not automated typosquatting detection, registry-hash authentication, Git provenance verification, a CVE database, or proof of safe installation. This is not a race-resistant sandbox or a total runtime guarantee.
// choose with context
Is Package Supply-Chain Sentinel the right skill?
It returns
Heuristic findings for review, plus references for separate manual evidence checks.
Do not use it as
Not automated typosquatting detection, registry-hash authentication, Git provenance verification, a CVE database, or proof of safe installation.
Compatibility, access, version, and licence
- Reads or accesses
- Stable, reviewed non-secret local text snapshots. Review reports before sharing; filenames can be sensitive. No package installation or lifecycle-hook execution.
- Compatibility
- Python 3.10+ and an agent host that can retrieve the supporting files and execute local Python. Agensi provides agent-connected access; extract the complete folder only for a separately obtained downloadable package. An AI-agent subscription or setup service is not included.
- Version
- Agensi: package v1.1.2 (platform release v1.3). Gumroad download: v1.1.2. Checked October 22, 2026.
- Licence
- Review the package licence and seller terms at the linked destination.
Questions
Does a clean scan prove a dependency is safe?
Not automated typosquatting detection, registry-hash authentication, Git provenance verification, a CVE database, or proof of safe installation.
Add Package Supply-Chain Sentinel to your toolkit.
Agensi: package v1.1.2 (platform release v1.3). Gumroad download: v1.1.2. Checked October 22, 2026. Check prerequisites and the package version before purchase.
Get Package Supply-Chain Sentinel on Agensi