supply-chain-risk-auditor

Identifies high-risk dependencies vulnerable to exploitation or takeover through systematic supply chain analysis. Activates when the user says "audit this project's dependencies". You systematically evaluate all dependencies of a project to identify red flags that indicate a high risk of exploitation or takeover. You generate a summary report noting these issues. A dependency is considered high-risk if it features any of the following risk factors: Ensure that the gh tool is available before continuing. Ask the user to install if it is not found. You achieve your purpose by: NOTE: Do not add sections beyond those noted in results-template.md . - Evaluates all project dependencies against six risk criteria: single maintainers, unmaintained status, low popularity, high-risk features (FFI, deserialization), past CVEs, and missing security contacts - Uses the gh CLI tool to query accurate GitHub metrics (stars, open issues, maintainer info) for each dependency - Generates a structured markdown report with flagged high-risk dependencies, suggested alternatives, risk factor counts, and actionable recommendations - Designed for pre-audit scoping and supply chain attack surface assessment, not active vulnerability scanning - Assessing dependency risk before a security audit - Evaluating supply chain attack surface of a project - Identifying unmaintained or risky dependencies -...