security-review-owasp-dependency-graph-sbom

What problem does it solve?

This Skill helps security reviewers assess dependency graph and SBOM-related risks without manually reconstructing OWASP guidance during every review. It focuses on the trust boundaries, privilege paths, and operational assumptions that can turn dependencies or deployment choices into attack paths.

Core Features & Use Cases

• Dependency Trust Review: Evaluates third-party packages, plugins, images, and modules for pinning, provenance, and update discipline.
• Runtime and Isolation Analysis: Checks service accounts, containers, tenants, namespaces, and management surfaces for excessive privilege or weak separation.
• Operational Assurance Checks: Looks for scanning, policy enforcement, CI/CD safeguards, and rollback readiness that reduce supply-chain and deployment risk.
• Use Case: Review a platform service to confirm its dependency chain, runtime permissions, and deployment controls do not expose privileged control-plane access or cross-tenant compromise paths.

Quick Start

Use the security-review-owasp-dependency-graph-sbom skill to review the target service or repository for dependency trust, privilege boundaries, and deployment exposure.