# Gate 3 — supply-chain

**Question:** did anything enter the dependency or agent-config surface unreviewed?

## Why it matters

The fastest way to compromise a codebase in 2026 is not to attack it — it is to
get an agent to *invite the attacker in*. A dependency added to satisfy an
import, a skill or template pulled from a repo nobody read, a lockfile entry
that resolves to a typosquat, an `AGENTS.md` edit that quietly grants the agent
a new permission. Each arrives as an ordinary line in an ordinary diff.

This gate is the merge-time companion to the free
[`agent-security`](https://github.com/0xNyk/agent-security) tool: `agent-security`
scans and vets content as it enters; this check makes "was it reviewed?" a
release condition rather than a hope.

## The automated pass

The CLI **fails** the gate when any dependency manifest, lockfile, `.claude/`
config, or agent-instruction file changed and is not listed in
`supply_chain_reviewed`. Recording it there is you asserting a human looked.

## Record here

- [ ] Every new dependency is one you can name a reason for.
- [ ] Each was checked for typosquatting, and resolves to the package you meant.
- [ ] No install/postinstall/lifecycle script was added or newly enabled unreviewed.
- [ ] No skill, template, or MCP server was adopted without reading it — including
      whether it contains instructions aimed at your agent.
- [ ] No agent-config change widened permissions or destructive capability.

## Config

```json
{ "supply_chain_reviewed": ["package.json", "pnpm-lock.yaml"] }
```

## The rule of thumb

A dependency is a person you are trusting. Review the person, not just the code.