supply-chain-audit

Audit NuGet, npm, and pip dependencies for vulnerabilities and license compliance.

2|Updated Jan 31, 2026

Search Tags:#npm #pip #nuget #dependency audit #supply chain #vulnerability scanning #license compliance

Ready to run

npx skills add https://github.com/michaelalber/ai-toolkit --skill supply-chain-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supply-chain-audit
Source: https://github.com/michaelalber/ai-toolkit/tree/main/skills/supply-chain-audit
Command: npx skills add https://github.com/michaelalber/ai-toolkit --skill supply-chain-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need to identify and mitigate risks within your software's dependencies, protecting against vulnerabilities, license violations, and outdated components.

Core Features & Use Cases

Vulnerability Scanning: Detects known CVEs in NuGet, npm, and pip packages.
License Compliance: Analyzes dependency licenses for compatibility with your project.
Maintenance Health: Assesses if dependencies are actively maintained and secure.
Use Case: Before deploying a new version of your .NET application, use this Skill to scan all NuGet packages for critical vulnerabilities and ensure all licenses comply with your company's policy.

Quick Start

Run a full supply chain audit on the current project, checking for vulnerabilities and license compliance.

Frequently Asked Questions about supply-chain-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit npm and pip dependencies for vulnerabilities and license compliance?▼

To audit npm and pip dependencies, you run a comprehensive supply chain scan that detects known CVEs, analyzes license compatibility matrices, and assesses dependency maintenance health across multiple ecosystems.

What is software supply chain auditing and when do I need it?▼

Software supply chain auditing is the process of identifying vulnerabilities, license violations, and outdated components in your project dependencies. You need it before deploying new application versions to ensure security and compliance.

Can I check NuGet package vulnerabilities and maintenance health before a .NET deployment?▼

Yes, you can scan NuGet packages to identify critical vulnerabilities using CVSS interpretation, verify license compliance against company policy, and evaluate whether dependencies are actively maintained and secure.

Does dependency vulnerability scanning work across npm, pip, and NuGet simultaneously?▼

Dependency vulnerability scanning works across npm, pip, and NuGet ecosystems simultaneously, requiring integration with ecosystem-specific scanning tools and vulnerability databases to generate detailed reports.

What's the best way to assess license compatibility for software dependencies?▼

The best way to assess license compatibility is to generate a license compatibility matrix that analyzes dependency licenses against your project requirements, identifying potential violations before deployment.

Why does a dependency audit report include CVSS scores and maintenance indicators?▼

A dependency audit report includes CVSS scores to interpret vulnerability severity and maintenance indicators to assess if dependencies are actively maintained, providing a complete view of supply chain risks.