orbit-sec-supply-chain

What problem does it solve?

This Skill helps in ensuring supply chain security by auditing Composer and npm dependencies, checking for license compatibility, detecting abandoned packages, and identifying potential risks such as typosquatting, post-install scripts, lockfile integrity, and direct GitHub dependencies without version pinning.

Core Features & Use Cases

• Dependency Security: Checks for known CVEs in dependencies, providing insights on potential security risks.
• License Compliance: Verifies that dependencies are GPL-compatible, ensuring compliance with WordPress.org requirements.
• Abandoned Package Detection: Identifies abandoned packages that could pose security risks due to lack of updates.
• Typosquatting Risk Assessment: Flags suspicious package names that might be typosquatting popular ones.
• Lockfile Integrity: Ensures the integrity of lockfiles against composer.json or package.json, preventing mismatched installations.
• Direct GitHub Dependency Handling: Pinning to specific commit hashes for security and version control.
• Use Case: For a WordPress plugin development team looking to secure their plugin's dependencies against potential security vulnerabilities before release.

Quick Start

Run the skill with the following commands within your plugin directory: composer audit and npm audit. For deeper analysis, use Orbit's script: bash ~/Claude/orbit/scripts/supply-chain-audit.sh ~/plugins/my-plugin.