What problem does it solve?
This skill eliminates the manual, error-prone work of tracking project dependencies, identifying vulnerable or unmaintained packages, and generating compliant software bill of materials (SBOMs) for supply chain security audits.
Core Features & Use Cases
- Dependency Enumeration: Automatically parse common manifests like package.json, requirements.txt, Cargo.lock, and go.sum to inventory all direct and transitive dependencies, flagging unpinned transitive packages as a risk.
- Risk Correlation: Cross-reference dependencies against OSV advisories, Spectra Assure reports, and OpenSSF Scorecards to identify malicious packages, critical CVEs, and unmaintained libraries with low bus factor.
- SBOM Generation: Produce signed CycloneDX or SPDX SBOMs for compliance requirements, or lightweight custom SBOMs when no Spectra Assure Portal project exists.
Use case: A development team can use this skill to assess the security posture of their application's dependency tree before a production release, prioritizing fixes for the highest-risk packages first.
Quick Start
Use the supply-chain-analysis skill to audit the dependencies of the project in your current working directory and generate a prioritized list of supply chain risks along with a saved SBOM file.
