GitHub, Git & DevOps · IN-DEPTH PROFILE

supply-chain-risk-auditor

Measured dependency risk reports covering advisories, maintainers, abandonment, and install scripts.

View listed source ↗Installation guide ↓
Best for

Security teams reviewing third-party dependency exposure

What you get

Collect dependency evidence + Separate unknown from clean

Main limitation

Does not fully parse yarn.lock, pnpm-lock.yaml, poetry.lock, or unsupported ecosystems.

First risk

Registry and repository metadata exposure. Collection makes external requests for project dependency names and versions. Confirm that package metadata may leave the environment and keep private registry credentials scoped.

EVIDENCE FRESHNESS

Three checks, kept separate

A recent source check is not a runtime test or security audit.

Upstream sourceChecked 2026-08-20

Pinned revision · 9b281335

Open pinned commit ↗
SkillSignal profileEditorial metadata

Updated 2026-08-20

Runtime & securityNot independently verified

Source review does not certify behavior or safety.

30-SECOND BRIEF

What it does—and when it fits

Supply Chain Risk Auditor is Trail of Bits' measured dependency-audit workflow for npm, PyPI, and Go projects. Deterministic collectors inspect direct and lockfile dependencies for advisories, abandonment, publisher concentration, and install scripts before human interpretation is added.

INSTALL BY AGENT

Choose your Agent

Paths come from official Agent docs or the universal installer behind skills.sh. Compatibility still follows this Skill's record.

Native

This Skill's current record explicitly names this Agent. Still inspect scripts, permissions, and external dependencies first.

Project scope.claude/skills/supply-chain-risk-auditor/
Personal scope~/.claude/skills/supply-chain-risk-auditor/

Use project scope for team sharing and personal scope across repositories. The installer defaults to project scope; add -g for personal scope.

Install command (project scope)npx skills add trailofbits/skills --skill supply-chain-risk-auditor --agent claude-code
Official agent docs

Claude Code discovers custom Skill folders automatically at project or personal scope.

View path evidence ↗

TYPICAL WORKFLOW

A practical workflow

01

Collect dependency evidence

Measure supported manifests and lockfiles instead of estimating from memory.

02

Separate unknown from clean

Mark unavailable criteria as unassessable rather than silently passing them.

03

Prioritize remediation

Add verified upgrade paths and replacement candidates to the factual report.

THE TRADEOFFS

Advantages and tradeoffs

Notable strengths

  1. Deterministic scripts preserve the datum behind each verdict.
  2. Refuses to treat missing measurements as clean results.

Limitations

  1. Does not fully parse yarn.lock, pnpm-lock.yaml, poetry.lock, or unsupported ecosystems.
  2. Repository health and advisory data can be incomplete, delayed, or unavailable without authentication.

COMPARE THE TRADEOFF

Consider these close alternatives

These are deterministic nearby candidates, not paid placements or a universal ranking. Open the full profile before choosing.

01

Same job family · native to Claude Code

appinsights-instrumentation

AppInsights Instrumentation is a reference Skill for adding Azure Application Insights telemetry patterns and SDK configuration to supported web applications.
Tradeoff to check
It is guidance only; requests to add or change components must route to Azure Prepare.
First risk
Sensitive or excessive telemetry · High
Source state
Pinned · ea76537e
Open profile ↗
02

Same job family · native to Claude Code

azure-ai

Azure AI is Microsoft's compact service guide for Azure AI Search, Speech, Azure OpenAI, and Document Intelligence.
Tradeoff to check
It is a broad routing and reference Skill, not an end-to-end provisioning or production deployment workflow.
First risk
Sensitive content and billable AI operations · High
Source state
Pinned · ea76537e
Open profile ↗
03

Same job family · native to Claude Code

azure-aigateway

Azure AI Gateway configures Azure API Management as a governance layer for AI models, MCP tools, and agents.
Tradeoff to check
It requires Azure CLI for configuration and testing, and does not provision the APIM instance itself.
First risk
Misconfigured gateway policy or exposed key · High
Source state
Pinned · ea76537e
Open profile ↗
Compare more in the directory →

BEST FIT

Who it is for

→

Security teams reviewing third-party dependency exposure

→

Engineering leads assessing a dependency tree before release or engagement

BEFORE YOU USE IT

Risks to review before use

High

Registry and repository metadata exposure

Collection makes external requests for project dependency names and versions. Confirm that package metadata may leave the environment and keep private registry credentials scoped.

SECURITY

What the permission profile means

  • Keep collector output outside the audited repository unless explicitly requested.
  • Label replacement suggestions as judgment, not measured fact.

Not a security certification. External ratings are attributed references. SkillSignal has not independently executed or security-reviewed this Skill.

INSIDE THE PACKAGE

Indexed files

SKILL.mdUpstream package contentSource-linked
scripts/collect.pyUpstream package contentSource-linked
scripts/render.pyUpstream package contentSource-linked

TAGS

supply-chaindependenciesadvisories

Original SkillSignal editorial profile grounded in Trail of Bits commit 9b281335, checked 2026-08-20; not independently executed or security-certified.