{
  "id": "python-packaging-supply-chain-agent",
  "name": "Python Packaging and Supply Chain Agent",
  "version": "0.1.0",
  "type": "agent",
  "provider": "python",
  "harnesses": [
    "codex",
    "copilot",
    "claude-code",
    "cursor",
    "gemini",
    "kiro"
  ],
  "summary": "Static review of Python packaging and software supply-chain integrity: pyproject build metadata, dependency locking and hash-checking, index trust and dependency confusion, build isolation, dependency specifiers, license metadata, and CI release-token exposure. Reads manifests and lockfiles only; never installs packages or resolves environments.",
  "source_type": "original",
  "official_docs": [
    "https://packaging.python.org/en/latest/specifications/pyproject-toml/",
    "https://pip.pypa.io/en/stable/topics/secure-installs/",
    "https://pip.pypa.io/en/stable/topics/repeatable-installs/",
    "https://packaging.python.org/en/latest/specifications/dependency-specifiers/"
  ],
  "security_notes": "Static review only — reads `pyproject.toml`, `requirements`/constraints files, lockfiles, and CI definitions to assess locking, hashing, index trust, and build-isolation posture; never runs `pip install`, never resolves or downloads a package, and never contacts an index. A claim that a specific version is vulnerable is flagged as needing confirmation against an advisory source rather than asserted. Never requests index credentials, publish tokens, or customer data, and never installs an unreviewed package to inspect it.",
  "last_verified": "2026-07-26",
  "path": "agents/python/python-packaging-supply-chain-agent/",
  "harness_variants": {
    "codex": "agents/python/python-packaging-supply-chain-agent/harnesses/codex.toml",
    "copilot": "agents/python/python-packaging-supply-chain-agent/harnesses/copilot.agent.md",
    "claude-code": "agents/python/python-packaging-supply-chain-agent/harnesses/claude-code.agent.md",
    "cursor": "agents/python/python-packaging-supply-chain-agent/harnesses/cursor.agent.md",
    "gemini": "agents/python/python-packaging-supply-chain-agent/harnesses/gemini.agent.md",
    "kiro-ide": "agents/python/python-packaging-supply-chain-agent/harnesses/kiro-ide.agent.md",
    "kiro-cli": "agents/python/python-packaging-supply-chain-agent/harnesses/kiro-cli.agent.json"
  },
  "companion_skills": [
    "python-packaging-supply-chain"
  ],
  "execution_tier": "static-review",
  "lifecycle": "experimental",
  "author": "github: VincentChuWaiChow"
}