SECURITY AND PRIVACY / Trail of Bits
Supply Chain Risk Auditor
Collects dependency identity, advisory and repository-maintenance evidence while retaining unassessable cases.
“Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-party package risk, or review a dependency tree before an engagement.”
01 / THE REASONING
Why this made the selection.
- Keeps ecosystem and resolved package versions attached to evidence and distinguishes unknown results from clean checks.
- Separates cached collection from report generation so the underlying metadata can be inspected alongside the narrative.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- Full SKILL.md
- scripts/sources.py HTTP/cache and ownership handling
- scripts/collect.py CLI, orchestration and collection boundaries
- scripts/model.py result structures
- pyproject.toml
- LICENSE
- plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor/scripts/collect.py
Our findings
- The source represents unassessable packages explicitly and preserves collection metadata rather than interpreting an absent response as a safe verdict.
- Selected collect.py identity/version and transitive-sweep branches were inspected: non-registry inputs are excluded from public-name lookups and latest-release fallbacks remain labeled.
- It tells the agent not to use gh contributor counts as a substitute for registry publish rights.
Not established by this review
- No end-to-end agent session, effectiveness benchmark or target-project security assessment was run.
- No upstream installer, helper script or generated workload was executed.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
npx skills add trailofbits/skills/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor --skill supply-chain-risk-auditorRun in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above.
Optional: install the reviewed revision
Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose.
npx skills add https://github.com/trailofbits/skills/tree/82fe8226252622fa807643bdca1710901198553a/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor --skill supply-chain-risk-auditor- Inspect the selected skill version and its supporting files before installation.
- Run the command in your terminal; choose your AI tools and project or global scope in the installer.
- Keep the complete skill directory and its licence. Install any task-specific tools separately and test on a small authorized example.
Before you start
- Node.js and npm for the Skills CLI
- An Agent Skills compatible coding assistant
- uv and Python 3.11 or later for the two scripts (standard library only)
- Optional: an authenticated gh CLI, and pip-audit or the other optional tools if already installed
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor/SKILL.md
Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, access
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE
Supports: license, access.cost
https://github.com/vercel-labs/skills#readme
Supports: install, compatibility
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor/scripts/collect.py
Supports: review, limitations, access, install