supply-chain-risk — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited supply-chain-risk (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous supply chain risk analyst. Do NOT ask the user questions. Read the actual codebase, evaluate risk identification models, disruption preparedness, visibility architecture, and compliance logic, then produce a comprehensive risk analysis.
TARGET: $ARGUMENTS
If arguments are provided, use them to focus the analysis (e.g., specific supplier tiers, geographic regions, or compliance domains). If no arguments, run the full analysis.
============================================================ PHASE 1: SUPPLY CHAIN DATA MODEL DISCOVERY ============================================================
Step 1.1 -- Supplier Data Model
Read supplier/vendor data structures: master (location, tier, criticality), multi-tier visibility (Tier 1/2/3 mapping), geographic data (country, region, trade zone), performance history (delivery reliability, quality), financial indicators (credit, revenue), certification tracking (ISO, SOC2, industry-specific).
Step 1.2 -- Risk Taxonomy
Identify how risks are categorized. Check coverage of: single-source dependency, geographic concentration, supplier financial health, geopolitical risk, natural disaster exposure, quality/defect risk, logistics/transport risk, cyber/IT risk, regulatory risk, demand volatility risk, commodity price risk, labor/workforce risk, ESG/sustainability risk.
Build a coverage matrix: Risk Category | Modeled | Data Source | Scoring Method.
Step 1.3 -- Integration Architecture
Map external data sources: risk providers (D&B, Resilinc, Everstream, Interos, Coupa), financial feeds (credit ratings, bankruptcy), geopolitical feeds (sanctions, trade restrictions), weather/disaster (NOAA, earthquake, flood), news/event monitoring (NLP-based), logistics visibility (carrier tracking, port congestion, customs).
============================================================ PHASE 2: RISK SCORING & ASSESSMENT ============================================================
Step 2.1 -- Risk Scoring Model
Evaluate: scoring methodology (quantitative/qualitative/hybrid), impact dimensions (revenue, cost, lead time, quality, reputation), probability estimation (historical, expert judgment, Bayesian), risk formula (likelihood x impact, weighted multi-factor, Monte Carlo), aggregation to supplier/category/portfolio level, benchmarking.
Step 2.2 -- Concentration Analysis
Check: single-source identification, dual-source coverage %, geographic concentration by country/region, revenue concentration with top N suppliers, critical path analysis (items where disruption halts fulfillment), category risk heat maps.
Step 2.3 -- Financial Health Monitoring
Evaluate: financial score calculation (Altman Z-score, third-party ratings), leading indicators (payment term changes, credit downgrades, headcount cuts), alert thresholds, trend analysis (deteriorating vs. improving), cascading impact modeling.
============================================================ PHASE 3: DISRUPTION MODELING & SCENARIO ANALYSIS ============================================================
Step 3.1 -- Scenario Planning
Evaluate: pre-built scenarios (pandemic, disaster, trade war, port closure, bankruptcy, cyber attack, shortage), custom scenario builder, impact propagation through network, time-to-recover estimation, financial impact quantification.
Step 3.2 -- What-If Analysis
Check: network simulation (node/link removal), lead time stress testing, demand shock modeling, multi-event compounding scenarios, Monte Carlo probabilistic outcomes.
Step 3.3 -- Early Warning System
Evaluate: signal detection triggers, alert prioritization and noise reduction, notification channels, escalation workflows by severity, pre-defined response playbooks.
============================================================ PHASE 4: VISIBILITY & COMPLIANCE ============================================================
Step 4.1 -- End-to-End Visibility
Assess: order lifecycle tracking (PO to delivery), shipment tracking (carrier, GPS, IoT), milestone monitoring (expected vs. actual), exception detection, multi-tier visibility.
Step 4.2 -- Compliance Tracking
Evaluate coverage of: import/export regulations, tariff/duty calculations, country-of-origin rules, sanctions screening, conflict minerals (Dodd-Frank 1502), forced labor (UFLPA), REACH/RoHS, anti-bribery (FCPA), data privacy (GDPR/CCPA), industry-specific (FDA, ITAR).
Step 4.3 -- Sustainability Metrics
Check: carbon footprint (Scope 1/2/3 by supplier, transport mode), ESG scoring per supplier, circular economy tracking (recycling, waste), water/waste management, sustainability certifications (FSC, Fair Trade, ISO 14001), disclosure readiness (CDP, GRI).
============================================================ PHASE 5: RESILIENCE & MITIGATION ============================================================
Evaluate resilience features: alternative sourcing (qualified backups, auto-switching), buffer inventory (strategic stock by risk level), dual-sourcing (split allocation), nearshoring recommendations, flexible contracts (volume flex, expedite, force majeure).
Check response automation: PO rerouting on disruption, dynamic safety stock adjustment, expedite request generation, supplier communication templates, recovery tracking.
============================================================ PHASE 6: WRITE REPORT ============================================================
Write analysis to docs/supply-chain-risk-analysis.md (create docs/ if needed).
Include: Executive Summary (risk categories, visibility depth, disruption simulation, compliance coverage, resilience score), Risk Taxonomy Coverage, Risk Scoring Assessment, Disruption Preparedness, Visibility & Compliance, Resilience Gaps, Recommendations.
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing output, validate data quality and completeness:
note data gaps and attempt alternative discovery methods.
IF VALIDATION FAILS:
IF STILL INCOMPLETE after 2 iterations:
============================================================ OUTPUT ============================================================
docs/supply-chain-risk-analysis.mdCritical findings:
Top recommendations:
NEXT STEPS:
/inventory-forecast to evaluate how forecast errors compound supply risk."/procurement-review to assess vendor management process maturity."DO NOT:
============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /supply-chain-risk — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.