# supply-chain-risk-auditor

Audits project dependencies for supply-chain risks, including advisories and signs of abandoned packages. Use it before a dependency review or security engagement.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 8100 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/supply-chain-risk-auditor

## What it does

The skill produces a report on direct npm, PyPI, and Go dependencies, then checks advisories against versions resolved by supported lockfiles. It also examines archived or abandoned upstream projects, npm publisher concentration, and scripts that run during installation. Two scripts collect and render the results: `collect.py` and `render.py`.

The project needs dependency manifests, `uv`, and an authenticated GitHub CLI session checked with `gh auth status`; without authentication, some repository criteria may be unassessable. The skill does not install or build dependencies and does not inspect project source code. It cannot read `yarn.lock`, `pnpm-lock.yaml`, or `poetry.lock`, so versions may rely on other available information.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill supply-chain-risk-auditor -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/supply-chain-risk-auditor/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/supply-chain-risk-auditor/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill supply-chain-risk-auditor -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/supply-chain-risk-auditor/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill supply-chain-risk-auditor -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/supply-chain-risk-auditor/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills supply-chain-risk-auditor
```

2. **Manually: put the files in place**
- File: `.github/skills/supply-chain-risk-auditor/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill supply-chain-risk-auditor -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/supply-chain-risk-auditor/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill supply-chain-risk-auditor -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor/SKILL.md

## When to use it
- check direct and lockfile-resolved dependencies for advisories
- identify abandoned or archived upstream projects
- assess concentration among npm publishers
- find scripts that run during installation
- produce a report with supporting data for its findings

## Example prompts
- Audit this project's dependencies for supply-chain risks.
- Check direct and transitive dependencies for advisories and prepare a report.
- Find abandoned dependencies and packages with install-time scripts.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md