GitHub, Git & DevOps · IN-DEPTH PROFILE

Supply Chain Risk Auditor Skill

Measured dependency risk reports covering advisories, maintainers, abandonment, and install scripts.

View listed source ↗Installation guide ↓
Best for

Security teams reviewing third-party dependency exposure

What you get

Collect dependency evidence + Separate unknown from clean

Main limitation

Does not fully parse yarn.lock, pnpm-lock.yaml, poetry.lock, or unsupported ecosystems.

First risk

Registry and repository metadata exposure. Collection makes external requests for project dependency names and versions. Confirm that package metadata may leave the environment and keep private registry credentials scoped.

EVIDENCE FRESHNESS

Three checks, kept separate

A recent source check is not a runtime test or security audit.

Upstream sourceChecked 2026-09-23

Pinned revision · 32e34f81

Open pinned commit ↗
SkillSignal profileEditorial metadata

Updated 2026-09-23

Runtime & securityNot independently verified

Source review does not certify behavior or safety.

IN PLAIN ENGLISH

What it does—and when it fits

Supply Chain Risk Auditor is Trail of Bits' measured dependency-audit workflow for npm, PyPI, and Go projects. Deterministic collectors inspect direct and lockfile dependencies for advisories, abandonment, publisher concentration, and install scripts before human interpretation is added.

This is aimed at Security teams reviewing third-party dependency exposure. Compare the examples below with your task, then review the limitations, permissions, and risks before installing.

What you get
  • Collect dependency evidenceMeasure supported manifests and lockfiles instead of estimating from memory.
  • Separate unknown from cleanMark unavailable criteria as unassessable rather than silently passing them.
  • Prioritize remediationAdd verified upgrade paths and replacement candidates to the factual report.
What makes it different
  • Deterministic scripts preserve the datum behind each verdict.
  • Refuses to treat missing measurements as clean results.
Community signalNo attributed third-party rating yet

No verified review text is in the current dataset. Use the linked source for the latest discussion.

Read the source note ↗

INSTALL BY AGENT

Choose your Agent

Paths come from official Agent docs or the universal installer behind skills.sh. Compatibility still follows this Skill's record.

Native

This Skill's current record explicitly names this Agent. Still inspect scripts, permissions, and external dependencies first.

Project install (recommended)
npx skills add trailofbits/skills --skill supply-chain-risk-auditor --agent claude-code
Personal install
npx skills add trailofbits/skills --skill supply-chain-risk-auditor --agent claude-code -g

Project install stays with this repository for team sharing. Personal install adds -g and works across repositories.

View install paths
Project path.claude/skills/supply-chain-risk-auditor/
Personal path~/.claude/skills/supply-chain-risk-auditor/
Official agent docs

Claude Code discovers custom Skill folders automatically at project or personal scope.

View path evidence ↗

TYPICAL WORKFLOW

A practical workflow

01

Collect dependency evidence

Measure supported manifests and lockfiles instead of estimating from memory.

02

Separate unknown from clean

Mark unavailable criteria as unassessable rather than silently passing them.

03

Prioritize remediation

Add verified upgrade paths and replacement candidates to the factual report.

THE TRADEOFFS

Advantages and tradeoffs

Notable strengths

  1. Deterministic scripts preserve the datum behind each verdict.
  2. Refuses to treat missing measurements as clean results.

Limitations

  1. Does not fully parse yarn.lock, pnpm-lock.yaml, poetry.lock, or unsupported ecosystems.
  2. Repository health and advisory data can be incomplete, delayed, or unavailable without authentication.

COMPARE THE TRADEOFF

Consider these close alternatives

These are deterministic nearby candidates, not paid placements or a universal ranking. Open the full profile before choosing.

01

Same job family · native to Claude Code

containerize-aspnet-framework

Create Windows container files for ASP.NET Framework projects.
Tradeoff to check
Detailed package files are not fully catalogued.
First risk
Review before install · Medium
Source state
Pinned · 1f564408
Open containerize-aspnet-framework profile ↗
02

Same job family · native to Claude Code

create-github-issues-feature-from-implementation-plan

Split implementation-plan phases into trackable GitHub issues.
Tradeoff to check
Detailed package files are not fully catalogued.
First risk
Review before install · Medium
Source state
Pinned · 1f564408
Open create-github-issues-feature-from-implementation-plan profile ↗
03

Same job family · native to Claude Code

create-github-issues-for-unmet-specification-requirements

Open issues for specification requirements not yet implemented.
Tradeoff to check
Detailed package files are not fully catalogued.
First risk
Review before install · Medium
Source state
Pinned · 1f564408
Open create-github-issues-for-unmet-specification-requirements profile ↗
Compare more in the directory →

BEST FIT

Who it is for

→

Security teams reviewing third-party dependency exposure

→

Engineering leads assessing a dependency tree before release or engagement

BEFORE YOU USE IT

Risks to review before use

High

Registry and repository metadata exposure

Collection makes external requests for project dependency names and versions. Confirm that package metadata may leave the environment and keep private registry credentials scoped.

SECURITY

What the permission profile means

  • Keep collector output outside the audited repository unless explicitly requested.
  • Label replacement suggestions as judgment, not measured fact.

Not a security certification. External ratings are attributed references. SkillSignal has not independently executed or security-reviewed this Skill.

COMMON QUESTIONS

Supply Chain Risk Auditor Skill FAQ

What is the Supply Chain Risk Auditor Skill?

Measured dependency risk reports covering advisories, maintainers, abandonment, and install scripts. Supply Chain Risk Auditor is Trail of Bits' measured dependency-audit workflow for npm, PyPI, and Go projects. Deterministic collectors inspect direct and lockfile dependencies for advisories, abandonment, publisher concentration, and install scripts before human interpretation is added.

How do I install the Supply Chain Risk Auditor Skill?

Open and review the listed source, choose the project or personal path for your Agent, then verify the first run in a controlled project. Open the pinned commit and read the current SKILL.md.

Is the Supply Chain Risk Auditor Skill safe to use?

SkillSignal checked the source on 2026-09-23, but that is not a runtime test or security certification. Review the “Registry and repository metadata exposure” risk first and begin with the least access required.

INSIDE THE PACKAGE

Indexed files

SKILL.mdUpstream package contentSource-linked
scripts/collect.pyUpstream package contentSource-linked
scripts/render.pyUpstream package contentSource-linked

TAGS

supply-chaindependenciesadvisories

Original SkillSignal editorial profile grounded in Trail of Bits commit 32e34f81, checked 2026-09-23; not independently executed or security-certified.