Skip to main content
Back to registry

supply-chain-risk-auditor

trailofbits/skills

Activates when the user says "audit this project's dependencies".

Installs279
Install command
npx skills add https://github.com/trailofbits/skills --skill supply-chain-risk-auditor
Security audits
Gen Agent Trust HubPASS
SocketPASS
SnykWARN
About this skill
Activates when the user says "audit this project's dependencies". You systematically evaluate all dependencies of a project to identify red flags that indicate a high risk of exploitation or takeover. You generate a summary report noting these issues. A dependency is considered high-risk if it features any of the following risk factors: Ensure that the gh tool is available before continuing. Ask the user to install if it is not found. You achieve your purpose by: NOTE: Do not add sections beyond those noted in results-template.md . - Assessing dependency risk before a security audit - Evaluating supply chain attack surface of a project - Identifying unmaintained or risky dependencies - Pre-engagement scoping for supply chain concerns - Active vulnerability scanning (use dedicated tools like npm audit, pip-audit) - Runtime dependency analysis - License compliance auditing - Single maintainer or team of individuals - The project is primarily or solely maintained by a single individual, or a small number of individuals. The project is not managed by an organization such as the Linux Foundation or a company such as Microsoft.

Source description provided by the upstream skill listing. Community reviews and install context appear in the sections below.

Community Reviews

Latest reviews

Sign in to review

No community reviews yet. Be the first to review.

Browse this skill in context
FAQ
What does supply-chain-risk-auditor do?

Activates when the user says "audit this project's dependencies".

Is supply-chain-risk-auditor good?

supply-chain-risk-auditor does not have approved reviews yet, so SkillJury cannot publish a community verdict.

What agent does supply-chain-risk-auditor work with?

supply-chain-risk-auditor currently lists compatibility with codex, gemini-cli, opencode, cursor, kimi-cli, github-copilot.

What are alternatives to supply-chain-risk-auditor?

Skills in the same category include telegram-bot-builder, flutter-app-size, sharp-edges, iterative-retrieval.

How do I install supply-chain-risk-auditor?

npx skills add https://github.com/trailofbits/skills --skill supply-chain-risk-auditor

Related skills

More from trailofbits/skills

Related skills

Alternatives in Software Engineering