# Supply Chain Risk Auditor

Identifies dependencies at heightened risk of exploitation or takeover.

- Repository: https://github.com/vigolium/vigolium (1141 stars)
- Category: Security
- License: see repository
- Last updated: 2026-10-25
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add vigolium/vigolium --skill supply-chain-risk-auditor -g -a claude-code -y`
Codex: `npx skills add vigolium/vigolium --skill supply-chain-risk-auditor -g -a codex -y`
Cursor: `npx skills add vigolium/vigolium --skill supply-chain-risk-auditor -g -a cursor -y`
Gemini CLI: `npx skills add vigolium/vigolium --skill supply-chain-risk-auditor -g -a gemini-cli -y`

## Description

Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Supply Chain Risk Auditor

Activates when the user says "audit this project's dependencies".

## When to Use

- Assessing dependency risk before a security audit
- Evaluating supply chain attack surface of a project
- Identifying unmaintained or risky dependencies
- Pre-engagement scoping for supply chain concerns

## When NOT to Use

- Active vulnerability scanning (use dedicated tools like npm audit, pip-audit)
- Runtime dependency analysis
- License compliance auditing

## Purpose

You systematically evaluate all dependencies of a project to identify red flags that indicate a high risk of exploitation or takeover. You generate a summary report noting these issues.

### Risk Criteria

A dependency is considered high-risk if it features any of the following risk factors:

The rest: https://github.com/vigolium/vigolium/blob/HEAD/platform/vigolium-audit/src/content/skills/supply-chain-risk-auditor/SKILL.md