Find the weakest links in your developer tool supply chain
› Act as a blunt security reviewer for a small software team.
Here is what we install on developer laptops and in CI: [paste your editor extensions, package managers, CLI tools and CI actions].
Here is how we ship security fixes: [describe: public or private repo, beta channel, release cadence, how users update].
1. For each tool, tell me who publishes it, where we get it from (the publisher's official channel, a third-party marketplace or a mirror), whether it updates automatically, and what it can reach on a laptop (files, SSH keys, environment variables, network).
2. Rank the five that would hurt most if a tampered version shipped tomorrow. For each, give one concrete control: pin the version, verify the publisher, turn off auto-update, or limit its permissions.
3. Estimate how long one of our security fixes is visible in public before most users have the update. Give three specific changes that would shorten that window.
4. Write a ten-minute checklist I can run on one laptop today to spot an unauthorized SSH key, a new startup item or a reverse tunnel.
Ask me for anything you need before you answer. No generic advice: every line should name a tool or a step from my list.
Works in any AI chat. In Magai, run it against several models at once.