What problem does it solve? Teams routinely install third-party dependencies without verifying their source, license, integrity, or removal path, creating hidden security, legal, and operational risk. This Skill turns every dependency decision into an evidence-backed review instead of a blind installation step. ## Core Features & Use Cases - Provenance and Identity Verification: Confirm canonical source, publisher, exact version, and immutable identity before trusting a component. - License and Integrity Review: Record license and redistribution implications, prefer pinned versions with verified hashes or signatures, and inspect install/update hooks proportionately to risk. - Risk Dispositions and STOP Conditions: Classify components with explicit dispositions (e.g., INTEGRATION CANDIDATE, LICENSE / PROVENANCE BLOCKED, REJECT / STOP) and halt when provenance is missing or rollback is unavailable. - Use Case: Before adding a new npm package to a production service, use this Skill to verify the publisher, pin the version with a checksum, check known advisories, document transitive dependencies, and define a removal path. ## Quick Start Ask the AI to review a specific dependency using the signalproof-supply-chain contract before integrating it into your project.
