ai-supply-chain-security

AI Supply Chain Security

Cross-platform AI Coding security scanner for OpenClaw and Claude Code, detecting hooks configuration risks, MCP server attacks, prompt injection, and supply chain attacks (npm/PyPI/Rust).

Skill Information

name: ai-supply-chain-security
version: 2.1.0
description: Cross-platform AI Coding security scanner - Detect hooks, MCP servers, prompt injection, supply chain attacks, lock file poisoning, and registry substitution attacks
author: JavaMaGong
platforms: [Windows, macOS, Linux]
category: security

Installation

OpenClaw

openclaw skills install ai-supply-chain-security

Manual Installation

# Clone repository
git clone https://github.com/javamagong/ai-supply-chain-security.git
Run directly (no install script needed)
python ai-scanner.py --help

Core Features

1. AI Assistant Hooks Detection

| AI Assistant | Config File | Detection Content | |-------------|-------------|-------------------| | Claude Code | .claude/settings.json | hooks, MCP servers, permissions | | Cursor | .cursorrules | Prompt injection | | Generic | CLAUDE.md | Prompt injection attacks |

2. MCP Server Security Detection

Scans MCP server configurations for:

3. Prompt Injection Detection

Detects suspicious patterns in CLAUDE.md and .cursorrules:

4. Supply Chain Security Detection

npm Packages:

Python Packages:

Rust Crates:

5. Lock File Poisoning Detection

package-lock.json / yarn.lock:

poetry.lock:

Cargo.lock:

6. Registry Substitution Attack Detection

.npmrc:

pip.conf / pip.ini:

7. GitHub Actions Security

8. Code Obfuscation Detection

CLI Usage

Basic Scan

# Scan current directory
python ai_scanner.py
Scan specific directory
python ai_scanner.py -d /path/to/project
Full scan with node_modules
python ai_scanner.py -d /path/to/project --full

Auto-Discovery Scan

# Scan all projects under directory
python auto_scanner.py -d /path/to/projects
Scan with specific severity filter
python auto_scanner.py -d /path/to/projects --severity critical

Output Formats

# Text output (default)
python ai_scanner.py -f text
JSON output
python ai_scanner.py -f json -o report.json
Markdown report
python ai_scanner.py -f markdown -o report.md

Configuration

Edit config.yaml:

scan_paths:
  - "./"
  - "../projects"
notification:
  webhook:
    enabled: false
    url: "${SECURITY_WEBHOOK_URL}"
  email:
    enabled: false
    smtp_host: "${SMTP_HOST}"
    smtp_port: 587
    from: "${SMTP_FROM}"
    to: "${SMTP_TO}"
    password: "${SMTP_PASSWORD}"
severity_threshold: "medium"
auto_fix: false

Detection Rules

Known Malicious npm Packages

AI Ecosystem Typosquatting Targets

Dangerous Patterns

CI/CD Integration

GitHub Actions

- name: Security Scan
  uses: actions/checkout@v3
  
name: Run AI Security Scanner
  run: |
    pip install -r requirements.txt
    python ai_scanner.py -d . -f json -o security-report.json
    
name: Upload Report
  uses: actions/upload-artifact@v3
  with:
    name: security-report
    path: security-report.json

Pre-commit Hook

repos:
  - repo: local
    hooks:
      - id: ai-security-scan
        name: AI Security Scanner
        entry: python ai_scanner.py -d .
        language: system
        pass_filenames: false

Requirements

License

MIT-0 - See LICENSE file

Author

JavaMaGong - https://github.com/javamagong

Changelog

See CHANGELOG.md for version history

Edit config.yaml:

scan_paths:
  - "./"
  - "../projects"
notification:
  webhook:
    enabled: false
    url: "${SECURITY_WEBHOOK_URL}"
  email:
    enabled: false
    smtp_host: "${SMTP_HOST}"
    smtp_port: 587
    from: "${SMTP_FROM}"
    to: "${SMTP_TO}"
    password: "${SMTP_PASSWORD}"
severity_threshold: "medium"
auto_fix: false