Supply Chain Risk Auditor

What it does

This skill analyzes a project's dependencies to identify potential risks like vulnerabilities or takeovers. It evaluates each dependency against six criteria, including maintainer status, popularity, and security history. The skill then generates a structured markdown report outlining flagged dependencies, suggested alternatives, and actionable recommendations for improving supply chain security.

When to use it

• Assessing dependency risk before a formal security audit.
• Evaluating the overall attack surface of a project’s supply chain.
• Identifying unmaintained or otherwise risky dependencies within a project.
• As part of pre-engagement scoping when concerns about supply chain risks arise.

Key capabilities

• Evaluates project dependencies against six risk criteria (single maintainers, unmaintained status, low popularity, high-risk features, past CVEs, missing security contacts).
• Uses the gh CLI tool to retrieve accurate GitHub metrics for each dependency.
• Generates a structured markdown report with flagged risks and recommendations.
• Designed for pre-audit scoping and attack surface assessment.

Example prompts

• "Audit this project's dependencies."
• "Can you assess the supply chain risk of my current project?"
• "Generate a dependency risk audit report."

Tips & gotchas

• This skill is not intended for active vulnerability scanning; use tools like npm audit or pip-audit for that purpose.
• The skill does not perform runtime dependency analysis.
• It relies on the gh CLI tool to query GitHub data, so ensure it's properly configured.