Skip to main content
affpapa.org
RU EN
skill CX Codex

supply-chain-risk-auditor — Claude Code skill for dependency audits

Audits project dependencies for supply-chain risks, including advisories and signs of abandoned packages. Use it before a dependency review or security engagement.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill supply-chain-risk-auditor -a claude-code
Open on GitHub

What supply-chain-risk-auditor does

The skill produces a report on direct npm, PyPI, and Go dependencies, then checks advisories against versions resolved by supported lockfiles. It also examines archived or abandoned upstream projects, npm publisher concentration, and scripts that run during installation. Two scripts collect and render the results: collect.py and render.py.

The project needs dependency manifests, uv, and an authenticated GitHub CLI session checked with gh auth status; without authentication, some repository criteria may be unassessable. The skill does not install or build dependencies and does not inspect project source code. It cannot read yarn.lock, pnpm-lock.yaml, or poetry.lock, so versions may rely on other available information.

What it helps with

  • check direct and lockfile-resolved dependencies for advisories
  • identify abandoned or archived upstream projects
  • assess concentration among npm publishers
  • find scripts that run during installation
  • produce a report with supporting data for its findings

Example prompts for the agent

  • Audit this project's dependencies for supply-chain risks.
  • Check direct and transitive dependencies for advisories and prepare a report.
  • Find abandoned dependencies and packages with install-time scripts.

How to install supply-chain-risk-auditor

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill supply-chain-risk-auditor -a claude-code

2Manually: put the files in place

~/.claude/skills/supply-chain-risk-auditor/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/supply-chain-risk-auditor/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about supply-chain-risk-auditor

How do I install supply-chain-risk-auditor in Claude Code?

Run npx skills add trailofbits/skills --skill supply-chain-risk-auditor -a claude-code. The skill file is installed at ~/.claude/skills/supply-chain-risk-auditor/SKILL.md.

What does supply-chain-risk-auditor do?

It creates a dependency risk report for npm, PyPI, and Go projects. The checks cover advisories, upstream status, npm publisher concentration, and install-time scripts.

Which lockfiles can the skill read?

It reads package-lock.json, npm-shrinkwrap.json, uv.lock, and go.mod for Go 1.17 or later. It does not read yarn.lock, pnpm-lock.yaml, or poetry.lock.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set77

semgrep Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. CX Codex +1 9,500installs differential-review Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. CX Codex +1 8,800installs modern-python Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. CX Codex +1 8,700installs codeql Runs interprocedural taint tracking and data flow analysis using CodeQL. Helps detect security flaws across nine programming languages. CX Codex +1 8,300installs secure-workflow-guide Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. CX Codex +1 7,400installs code-maturity-assessor This skill evaluates smart contracts and blockchain code across nine maturity categories. It produces evidence-backed ratings and a ranked improvement plan. CX Codex +1 7,100installs property-based-testing This skill helps create and inspect tests that check rules across generated inputs. Use it for parsers, serialization pairs, data structures, and Solidity contract invariants. CX Codex +1 7,000installs fp-check Walks a suspected vulnerability through verification and returns a TRUE POSITIVE or FALSE POSITIVE verdict backed by evidence. Built for confirming findings, not hunting new ones. CX Codex +1 7,000installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor