supply-chain-risk-auditor
Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-party package risk, or review a dependency tree before an engagement.
Pinned to revision 768a93096fb1, so it is the text this page describes rather than whatever the author pushed since.
Pre-approved tools experimental
Experimental field. Support varies between clients, so this list is what the author declared, not what your client will enforce.
- Read
- Write
- Bash
- Glob
- Grep
Files
- skills/supply-chain-risk-auditor/SKILL.md
- skills/supply-chain-risk-auditor/UPSTREAM-LICENSE.txt
- skills/supply-chain-risk-auditor/agents/openai.yaml
- skills/supply-chain-risk-auditor/assets/trail-of-bits-mark.svg
- skills/supply-chain-risk-auditor/scripts/collect.py
- skills/supply-chain-risk-auditor/scripts/model.py
- skills/supply-chain-risk-auditor/scripts/pyproject.toml
- skills/supply-chain-risk-auditor/scripts/render.py
- skills/supply-chain-risk-auditor/scripts/sources.py
- skills/supply-chain-risk-auditor/scripts/test_collect.py
- skills/supply-chain-risk-auditor/scripts/test_model.py
- skills/supply-chain-risk-auditor/scripts/test_render.py
- skills/supply-chain-risk-auditor/scripts/test_sources.py
- skills/supply-chain-risk-auditor/scripts/uv.lock
Every link opens the file at its source, pinned to the revision this page describes.