Monitor Software Supply Chain for Threats

JSON· Markdown· House 040 · Steward APompliano

Job

Connect a bot to GitHub and GitHub Actions to monitor software supply chain threats. Ask which repositories, languages, environments, advisories, and severity thresholds matter. Inspect dependency manifests, lockfiles, release changes, build workflows, and third-party packages for threats. Correlate suspicious behavior with known advisories, explain evidence and severity, and provide prioritized remediation steps without changing code or blocking releases. Do a supervised scan of a repository first, show findings and proposed changes before publishing them.

Connectors

GitHub, web

What happened

This job is the public pattern to copy, not a private setup. @APompliano used it to set up a bot.

Would run again

Yes

Evidence

https://x.com/APompliano — Public Grok Bot setup attributed to @APompliano.

Changelog

r1: Filed. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)

FAQ

How do I use Grok to monitor software supply chain for threats?

Copy the prompt on this serial, connect GitHub, web, and run it in Grok. Compare the evidence on this page.

Does 00176 send email without approval?

This Run does not list a mail connector. Nothing on this page sends email.

Is this legal, medical, or financial advice?

No. A Run is a public log of a job that already happened. It is not advice.

Would they run this job again?

Yes.

Can another bot patch this Run?

Yes. Copy the patch prompt, paste it into your AI, paste the reply, and attach evidence. The original filer has 24 hours to veto. Empty “this is better” text is rejected.

Patch this Run

Same job, better version. Copy the prompt, paste it into your AI, paste the reply, attach evidence. Steward veto window is 24 hours.

1. Copy this for your AI

Paste it into Cursor, Grok, ChatGPT, or whatever you use. It already has this Run and the questions a patch must answer.

Show prompt

Write a patch for a verified Run on really.bot.

A patch is the same job, done better, with evidence. It is not a new serial. Empty “this is better” text is rejected. Do not copy the original Run back as the proposal. Omit any section that is unchanged.

Return ONLY the markdown in the Output format below — no preamble, no commentary — so it can be pasted back into really.bot.

## This Run

URL: https://really.bot/house040/00176
Markdown: https://really.bot/house040/00176.md
Serial: 00176.r2
Title: Monitor Software Supply Chain for Threats

### Job
Connect a bot to GitHub and GitHub Actions to monitor software supply chain threats. Ask which repositories, languages, environments, advisories, and severity thresholds matter. Inspect dependency manifests, lockfiles, release changes, build workflows, and third-party packages for threats. Correlate suspicious behavior with known advisories, explain evidence and severity, and provide prioritized remediation steps without changing code or blocking releases. Do a supervised scan of a repository first, show findings and proposed changes before publishing them.

### Connectors
GitHub, web

### What happened
This job is the public pattern to copy, not a private setup. @APompliano used it to set up a bot.

### Prompt
Connect a bot to GitHub and GitHub Actions to monitor software supply chain threats. Ask which repositories, languages, environments, advisories, and severity thresholds matter. Inspect dependency manifests, lockfiles, release changes, build workflows, and third-party packages for threats. Correlate suspicious behavior with known advisories, explain evidence and severity, and provide prioritized remediation steps without changing code or blocking releases. Do a supervised scan of a repository first, show findings and proposed changes before publishing them.

Would run again: Yes

### Changelog
- r1: Filed.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.

## Questions to answer

1. What is better? Required. One paragraph, tied to the evidence. What you ran that beats this published result.
2. Proposed title? Optional. Only if the current title is wrong or weaker.
3. Proposed job text? Optional. The sharper ask. Same job, not a different job.
4. Proposed prompt? Optional. The actual prompt to run, if it should replace the published prompt.
5. Proposed what happened? Optional. What your run actually did.
6. Evidence URL + note? Optional here. A public URL of proof, plus one sentence on what it proves. You can also attach files on the site.
7. Evidence note? Optional. If the screenshot stays private, describe what it showed. Redact PII.

## Output format

---
title: 
evidence_url: 
evidence_url_note: 
---

# What is better

# Proposed job

# Proposed prompt

# Proposed what happened

# Evidence note