explain

分类: 数据与AI | 上传者: attach-dev | 下载: 0 | 版本: v1.0（最新）

使用 Attach-guard 查找软件包的供应链风险评分、警报和版本历史记录。当用户询问软件包的安全性时，或者当 Attach-guard 阻止安装并且您想了解原因时，请使用此选项。

更新日志: Source: GitHub https://github.com/attach-dev/attach-guard

目录结构

当前层级: tree/main/plugin/skills/explain/

📄 SKILL.md 1.7 KB

SKILL.md

---
name: explain
description: Look up a package's supply-chain risk score, alerts, and version history using attach-guard. Use this when a user asks about a package's safety, or when attach-guard blocks an install and you want to understand why.
argument-hint: "<package-name>"
allowed-tools: "Bash, Read"
---

# Explain Package Risk

When a user asks about the safety or risk profile of an npm/pnpm package, or when attach-guard has blocked or flagged an install, use this skill to provide detailed information.

## How to use

Run the attach-guard evaluate command via the plugin wrapper:

```bash
"${CLAUDE_PLUGIN_ROOT}/hooks/bootstrap.sh" evaluate npm install $ARGUMENTS
```

If no package name was provided as an argument, ask the user which package they want to look up.

This returns JSON with:
- **decision**: `allow`, `ask`, or `deny`
- **reason**: why the decision was made
- **packages**: array with score details, age, and alerts

## Interpreting results

- **supply_chain score**: measures supply chain integrity (author history, publish patterns, dependency health). Below 50 is high risk, 50-70 is gray band, above 70 is safe.
- **overall score**: composite of supply chain, quality, maintenance, and vulnerability metrics.
- **age_hours**: how recently this version was published. Versions under 48 hours old are blocked by default.
- **alerts**: specific issues like malware detection, known vulnerabilities, or quality concerns.

## Example response format

After running the command, explain the results to the user in plain language:
- State the decision and reason
- Highlight any concerning alerts with their severity
- If a version was blocked, explain which version would pass and why
- Suggest alternatives if the package is entirely denied

登录后下载/点赞/收藏 ❤ 6 | ★ 0

explain

目录结构

SKILL.md

举报内容

提示