Supply Chain Risk Auditor
Audits dependency and supply-chain risk from lockfiles, advisories, install behavior and publisher signals.
How to use it
Install it with the open Skills CLI (needs Node.js), then restart your agent:
npx skills add trailofbits/skills --skill supply-chain-risk-auditor- Download the ZIP from this page and unzip it.
- Put the
supply-chain-risk-auditorfolder in.claude/skills/inside your project (or~/.claude/skills/for all projects). - Restart Claude Code and call it with
/supply-chain-risk-auditor.
بالعربي
يدقق مخاطر الاعتماديات وسلسلة التوريد من ملفات القفل والتنبيهات وسلوك التثبيت ومؤشرات الناشر.
More for security
- /security-review (built into Claude Code): Runs a full security review of the pending changes on your branch.
- Security Review: Reviews auth, input handling, secrets and APIs before release, using a practical security checklist.
- Audit Context Building: Builds a precise picture of code flow, assumptions and dependencies before a security audit, so findings have context.