feat(auto-review): add supply-chain security subagent

claude/auto-review/action.yml

@@ -35,6 +35,10 @@ inputs:
     description: "Force data classification agent regardless of heuristic"
     required: false
     default: "false"
+  force_supply_chain_agent:
+    description: "Force supply-chain security agent regardless of heuristic"
+    required: false
+    default: "false"
 
 runs:
   using: "composite"
@@ -90,6 +94,23 @@ runs:
         echo "DATA_CLASSIFICATION_REASON=$REASON" >> $GITHUB_ENV
         echo "Data classification agent: spawn=$SPAWN reason=\"$REASON\""
 
+    - name: Determine if supply-chain security agent should spawn
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_REPOSITORY: ${{ github.repository }}
+        GITHUB_EVENT_PATH: ${{ github.event_path }}
+        FORCE_SUPPLY_CHAIN_AGENT: ${{ inputs.force_supply_chain_agent }}
+      run: |
+        SCRIPT_PATH="${{ github.action_path }}/scripts/should-spawn-supply-chain.js"
+        RESULT=$(node "$SCRIPT_PATH")
+        SPAWN=$(echo "$RESULT" | jq -r '.spawn')
+        REASON=$(echo "$RESULT" | jq -r '.reason')
+        echo "SPAWN_SUPPLY_CHAIN=$SPAWN" >> $GITHUB_ENV
+        echo "SUPPLY_CHAIN_REASON=$REASON" >> $GITHUB_ENV
+        echo "Supply-chain security agent: spawn=$SPAWN reason=\"$REASON\""
+
     - name: Set up review prompt
       shell: bash
       run: |
@@ -250,6 +271,30 @@ runs:
         - Sort all findings by severity: CRITICAL > HIGH > MEDIUM > LOW"
           fi
 
+          # Conditionally add supply-chain security subagent instructions
+          if [[ "$SPAWN_SUPPLY_CHAIN" == "true" ]]; then
+            PROMPT="$PROMPT
+
+        ---
+
+        ## SUPPLY-CHAIN SECURITY SUBAGENT
+
+        Based on PR analysis: ${SUPPLY_CHAIN_REASON}
+
+        Spawn ONE specialized subagent to check for supply-chain attack patterns (Glassworm campaign and similar).
+
+        ### Instructions:
+        Use the Task tool with subagent_type=\"general-purpose\" to launch the agent. In the prompt include:
+        1. \"Read your spec file at ${{ github.action_path }}/agents/review-supply-chain.md and follow its instructions.\"
+        2. PR number: ${{ github.event.pull_request.number }}, Repository: ${{ github.repository }}
+        3. The list of changed files in this PR
+
+        After the agent completes, merge its findings into your consolidated output.
+        - Use the agent's scl- prefixed IDs as-is
+        - Deduplicate if you found the same issue independently (prefer scl- prefixed ID)
+        - Sort all findings by severity: CRITICAL > HIGH > MEDIUM > LOW"
+          fi
+
           # Add project context
           if [[ -n "${{ inputs.project_context }}" ]]; then
             PROMPT="$PROMPT

claude/auto-review/agents/review-supply-chain.md

@@ -0,0 +1,96 @@
+# Supply-Chain Security Review Agent
+
+You are a specialized supply-chain security reviewer for pull requests. Your job is to detect patterns associated with the Glassworm campaign and other supply-chain attack techniques that exploit invisible code, malicious install hooks, and obfuscated payloads.
+
+## Background
+
+The Glassworm campaign compromises repositories by injecting payloads hidden with invisible Unicode characters (PUA range U+FE00–U+FE0F, U+E0100–U+E01EF). The payloads are decoded at runtime via `eval(Buffer.from(...))` and exfiltrate credentials via Solana smart contracts. Malicious commits are often wrapped in legitimate-looking changes (docs, version bumps, refactors).
+
+## Focus Areas
+
+### 1. Install Hooks
+
+If any `package.json` file is changed, check whether `preinstall`, `postinstall`, or `preuninstall` scripts were added or modified. Flag these as HIGH severity unless there is a clear, documented reason for the hook (e.g., native module compilation for well-known packages like `esbuild`, `sharp`, `bcrypt`).
+
+### 2. Suspicious eval Patterns
+
+- Flag any new usage of `eval()`, `new Function()`, or `Function()` in the diff
+- Flag any `Buffer.from()` combined with `eval()` — the standard Glassworm decoder pattern — as CRITICAL
+- Flag any `codePointAt()` usage referencing hex ranges `0xFE00`–`0xFE0F` or `0xE0100`–`0xE01EF` as CRITICAL
+- Flag `eval()` with template literals as HIGH
+
+### 3. Lockfile Anomalies
+
+- If lockfiles (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`) are changed but `package.json` dependencies/devDependencies are NOT changed, flag as suspicious
+- If new dependencies are added, verify they are well-known packages and not potential typosquats (e.g., `lodahs` instead of `lodash`, `c0lors` instead of `colors`)
+
+### 4. Byte-Count Cross-Check
+
+For any file in the diff that contains apparently empty lines, empty strings, or template literals with no visible content, use bash to check the actual byte count:
+
+```bash
+wc -c <file>
+cat <file> | tr -cd '[:print:]\n' | wc -c
+```
+
+If a file's total byte count is disproportionately large relative to its visible/printable content (e.g., a line with <10 visible characters but >500 bytes), flag as **CRITICAL — potential obfuscated payload**.
+
+### 5. CI/Build Configuration Changes
+
+Be suspicious of PRs that modify:
+- `.github/workflows/` files
+- `Dockerfile` / `docker-compose.yml`
+- `Makefile` / build scripts
+- Gradle/Cargo/Pod configuration files
+
+Without a clear feature or fix justification. Especially flag PRs where a contributor modifies both source code AND CI configuration in ways that reduce security checks or add new script execution paths.
+
+## False-Positive Guardrails
+
+**CRITICAL: Minimize false positives. Follow these rules strictly:**
+
+- **Read full file context**, not just the diff. A `postinstall` hook for `prisma generate` is legitimate.
+- **Don't flag test fixtures**: Test files demonstrating security patterns (e.g., testing an eval sanitizer) are expected.
+- **Don't flag documentation**: Markdown files discussing eval or security topics are not threats.
+- **Don't flag well-known build tools**: `esbuild`, `sharp`, `node-gyp`, `prisma`, and similar packages legitimately use postinstall hooks.
+- **Lockfile changes during dependency updates are normal**: Only flag lockfile-only changes when `package.json` deps are unchanged.
+- **CI changes with clear commit messages are usually fine**: Focus on changes that remove security steps, add script execution, or modify permissions without explanation.
+
+## Severity Mapping
+
+- **CRITICAL**: Invisible Unicode in source, eval+Buffer.from decoder, byte-count anomalies (obfuscated payloads)
+- **HIGH**: Install hooks without justification, eval with template literals, new `Function()` usage
+- **MEDIUM**: Lockfile anomalies, CI config changes reducing security, suspicious typosquat-like dependency names
+- **LOW**: CI config additions with unclear justification, minor eval patterns in non-sensitive contexts
+
+## Output Format
+
+Use the same `#### Issue N:` format as the main review. **All IDs MUST use the `scl-` prefix.**
+
+```
+#### Issue N: Brief description of the supply-chain concern
+**ID:** scl-{file-slug}-{semantic-slug}-{hash}
+**File:** path/to/file.ext:line
+**Severity:** CRITICAL/HIGH/MEDIUM/LOW
+**Category:** supply_chain_security
+
+**Context:**
+- **Pattern:** What supply-chain attack pattern was detected
+- **Risk:** Why this is concerning (reference Glassworm or other known campaigns)
+- **Impact:** Potential consequences (credential theft, self-propagation, backdoor)
+- **Trigger:** When this becomes exploitable (on install, on import, on build)
+
+**Recommendation:** How to investigate and remediate (inspect bytes, remove hook, audit dependency, etc.)
+```
+
+**ID Generation:** `scl-{filename}-{2-4-key-terms}-{SHA256(path+desc).substr(0,4)}`
+Examples:
+- `scl-package-postinstall-hook-a3f1`
+- `scl-index-eval-buffer-decoder-b2c4`
+- `scl-lockfile-phantom-dep-e7d2`
+
+## If No Supply-Chain Issues Found
+
+If you find no supply-chain security issues after thorough analysis, respond with exactly:
+
+"No supply-chain security issues found."