subagent

supply-chain-security — Claude Code subagent: dependency audit

Q: How do I install supply-chain-security in Claude Code?

Run `npx claude-code-templates@latest --agent security/supply-chain-security`, then add `.claude/agents/supply-chain-security.md`.

Q: Which lockfiles can the subagent inspect?

It covers `package-lock.json`, `yarn.lock`, `poetry.lock`, `Cargo.lock`, and `go.sum`, including version pins and content hashes.

Reviews project dependencies for vulnerabilities, malicious packages, license conflicts, SBOM gaps, and third-party supply chain risk.

Install into Claude Code · claude-code-templates All methods and platforms ↓

npx claude-code-templates@latest --agent security/supply-chain-security

Open on GitHub

What supply-chain-security does

This subagent maps direct and transitive dependencies, then checks them against CVE, GHSA, OSV, and NVD sources. It reviews lockfiles for loose versions, missing hashes, and unexpected changes. Package names that overlap with a public registry can expose a dependency confusion path.

It can guide SBOM work with CycloneDX or SPDX, inspect typosquatting and install scripts, and review GPL, MIT, Apache, and AGPL licensing concerns. Recommendations include ecosystem tools such as npm audit, pip-audit, cargo audit, govulncheck, bundler-audit, syft, and cdxgen. Findings are sorted into CRITICAL, HIGH, MEDIUM, and LOW tiers with a remediation command.

What it helps with

scan dependencies against vulnerability databases
spot malicious packages and unsafe install scripts
create an SBOM in CycloneDX or SPDX
verify lockfile pins and content hashes
review licenses across third-party components

Example prompts for the agent

Audit this project’s dependencies and group the findings by severity.
Review this package before I add it: check vulnerabilities, install scripts, and dependency confusion risk.
Generate an SBOM for my Python project and give me commands to scan it.

How to install supply-chain-security

1claude-code-templates

npx claude-code-templates@latest --agent security/supply-chain-security

2Manually: put the files in place

.claude/agents/supply-chain-security.md

For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

Manually: put the files in place

.codex/agents/supply-chain-security.toml

Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

Manually: put the files in place

.cursor/agents/supply-chain-security.md

Cursor also reads .claude/agents/

Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean

Questions about supply-chain-security

How do I install supply-chain-security in Claude Code?

Run npx claude-code-templates@latest --agent security/supply-chain-security, then add .claude/agents/supply-chain-security.md.

What does supply-chain-security do?

It examines dependencies, lockfiles, licenses, SBOMs, and third-party component risks. The report uses CRITICAL, HIGH, MEDIUM, and LOW severity tiers and includes remediation commands.

Which lockfiles can the subagent inspect?

It covers package-lock.json, yarn.lock, poetry.lock, Cargo.lock, and go.sum, including version pins and content hashes.

Similar subagents

All subagents for Security →

code-reviewer official Anthropic This subagent checks code changes for bugs, security issues, and project-rule violations. Use it when a review should focus on findings that matter. 31,050installs security-auditor official Anthropic This subagent searches code for security flaws and gives engineers concrete fixes. Use it to review a project before hardening or modernization work. 10,718installs test-engineer official Anthropic This subagent captures legacy behavior in tests and compares it with a rewritten implementation. Use it before changing existing modules. 9,715installs code-reviewer VoltAgent Community Reviews code changes for bugs, security flaws and maintenance issues. Use it before merging complex work or auditing a project. 31,050installs security-auditor VoltAgent Community Audits security controls, vulnerabilities, risks, and compliance gaps across systems, infrastructure, and processes. Use it when you need documented findings. 10,718installs devops-engineer VoltAgent Community This subagent reviews infrastructure and helps with CI/CD, containers, and deployment workflows. Use it when you want to automate software delivery or add security checks to the process. 7,392installs

From the same set804

The whole set →

test-changelog-automation Automates changelog testing workflows, validation rules, and release note checks inside CI/CD pipelines. 170installs arm-migration A subagent that hunts x86 assumptions in your repo and helps move builds and container images to ARM64. Made for teams heading to Arm infrastructure. 169installs powershell-windows Defines patterns for Windows PowerShell scripts, enforcing cmdlet parentheses, pure ASCII console output, and safe JSON parsing. Solves common syntax crashes. 169installs geo-fundamentals Use this skill to assess whether site content is ready to appear in AI-generated answers. It covers content structure, crawler access and citation tracking. 168installs force-push-blocker Intercepts and rejects git force push commands before Claude Code executes them in your shell. 167installs team-workload-balancer Analyzes developer workload, matches skills to sprint tasks, and balances assignments using local Git logs and Linear. 167installs rootly-incident-responder A Claude Code subagent for Rootly incident triage, historical matches, on-call coordination, and reviewed remediation plans. 167installs voidbeast-gpt41enhanced An autonomous full-stack subagent that picks its own mode, digs through the codebase and keeps working until the problem is solved. 166installs