# supply-chain-security

Reviews project dependencies for vulnerabilities, malicious packages, license conflicts, SBOM gaps, and third-party supply chain risk.

- subagent · `type=agent` · Claude Code · 168 installs
- Author: davila7
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/agents/security/supply-chain-security.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/agents/supply-chain-security

## What it does

This subagent maps direct and transitive dependencies, then checks them against CVE, GHSA, OSV, and NVD sources. It reviews lockfiles for loose versions, missing hashes, and unexpected changes. Package names that overlap with a public registry can expose a dependency confusion path.

It can guide SBOM work with CycloneDX or SPDX, inspect typosquatting and install scripts, and review GPL, MIT, Apache, and AGPL licensing concerns. Recommendations include ecosystem tools such as `npm audit`, `pip-audit`, `cargo audit`, `govulncheck`, `bundler-audit`, `syft`, and `cdxgen`. Findings are sorted into CRITICAL, HIGH, MEDIUM, and LOW tiers with a remediation command.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --agent security/supply-chain-security
```

2. **Manually: put the files in place**
- File: `.claude/agents/supply-chain-security.md` — For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

### Codex

**Manually: put the files in place**
- File: `.codex/agents/supply-chain-security.toml` — Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

### Cursor

**Manually: put the files in place**
- File: `.cursor/agents/supply-chain-security.md` — Cursor also reads .claude/agents/

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/agents/security/supply-chain-security.md

## When to use it
- scan dependencies against vulnerability databases
- spot malicious packages and unsafe install scripts
- create an SBOM in CycloneDX or SPDX
- verify lockfile pins and content hashes
- review licenses across third-party components

## Example prompts
- Audit this project’s dependencies and group the findings by severity.
- Review this package before I add it: check vulnerabilities, install scripts, and dependency confusion risk.
- Generate an SBOM for my Python project and give me commands to scan it.

## Similar
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/security-auditor.md) — subagent · 10718 installs
- [test-engineer](https://affpapa.org/en/nevibecode/agents/test-engineer.md) — subagent · 9715 installs
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/voltagent-community-security-auditor.md) — subagent · 10718 installs
- [devops-engineer](https://affpapa.org/en/nevibecode/agents/devops-engineer.md) — subagent · 7392 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 804 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md