Supply Chain Risk Auditor
Audits a project's dependencies for supply-chain risk: version-matched advisories for...
Install
npx skills add trailofbits/skills --skill supply-chain-risk-auditor -g -a claude-code -y- Repository
- trailofbits/skills7.9k
- Category
- Engineering
- Updated
- 7d ago
- License
- CC-BY-SA-4.0
- Context cost
- Mediumabout 1,624 tokens
- Runs scripts
- Yes, review before use
What it does
Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-party package risk, or review a dependency tree before an engagement.
Supply Chain Risk Auditor
Generates a supply-chain risk report for a project's direct dependencies (npm, PyPI, Go), plus an advisory sweep of everything its lockfile resolves. Two deterministic scripts do the measuring; your job is the judgment they refuse to automate.
Why the scripts do the measuring, not you
Every figure in this report is a claim about somebody else's project, and hand-collected
figures were measured wrong before this skill was rebuilt around scripts: GitHub
contributor counts said five-plus people maintain lodash where npm's ACL says one, and
gh saw zero downloads for a package that moves 164 million a week. Do not estimate
maintainer counts, downloads, staleness, or CVE history from gh, web search, or
memory, run the collector, and quote what it measured.
The scripts enforce two rules worth knowing before you read their output:
- Unavailable data is never evidence of risk. Every criterion resolves to assessed-clean, assessed-flagged, or unassessable-with-a-reason.
- An absent measurement is never a clean verdict. A run that measured nothing exits non-zero instead of printing a report that finds nothing.
