skills.rest
michaelalber
michaelalberCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

supply-chain-audit

Audit NuGet, npm, and pip dependencies for vulnerabilities and license compliance.

2|Updated Jan 31, 2026
Search Tags:#npm#pip#nuget#dependency audit#supply chain#vulnerability scanning#license compliance
One-click install
npx skills add https://github.com/michaelalber/ai-toolkit --skill supply-chain-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-audit
Source: https://github.com/michaelalber/ai-toolkit/tree/main/skills/supply-chain-audit
Command: npx skills add https://github.com/michaelalber/ai-toolkit --skill supply-chain-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need to identify and mitigate risks within your software's dependencies, protecting against vulnerabilities, license violations, and outdated components.

Core Features & Use Cases

  • Vulnerability Scanning: Detects known CVEs in NuGet, npm, and pip packages.
  • License Compliance: Analyzes dependency licenses for compatibility with your project.
  • Maintenance Health: Assesses if dependencies are actively maintained and secure.
  • Use Case: Before deploying a new version of your .NET application, use this Skill to scan all NuGet packages for critical vulnerabilities and ensure all licenses comply with your company's policy.

Quick Start

Run a full supply chain audit on the current project, checking for vulnerabilities and license compliance.

Frequently Asked Questions about supply-chain-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit npm and pip dependencies for vulnerabilities and license compliance?▼

To audit npm and pip dependencies, you run a comprehensive supply chain scan that detects known CVEs, analyzes license compatibility matrices, and assesses dependency maintenance health across multiple ecosystems.

What is software supply chain auditing and when do I need it?▼

Software supply chain auditing is the process of identifying vulnerabilities, license violations, and outdated components in your project dependencies. You need it before deploying new application versions to ensure security and compliance.

Can I check NuGet package vulnerabilities and maintenance health before a .NET deployment?▼

Yes, you can scan NuGet packages to identify critical vulnerabilities using CVSS interpretation, verify license compliance against company policy, and evaluate whether dependencies are actively maintained and secure.

Does dependency vulnerability scanning work across npm, pip, and NuGet simultaneously?▼

Dependency vulnerability scanning works across npm, pip, and NuGet ecosystems simultaneously, requiring integration with ecosystem-specific scanning tools and vulnerability databases to generate detailed reports.

What's the best way to assess license compatibility for software dependencies?▼

The best way to assess license compatibility is to generate a license compatibility matrix that analyzes dependency licenses against your project requirements, identifying potential violations before deployment.

Why does a dependency audit report include CVSS scores and maintenance indicators?▼

A dependency audit report includes CVSS scores to interpret vulnerability severity and maintenance indicators to assess if dependencies are actively maintained, providing a complete view of supply chain risks.

Related Skills

Explore More Software Engineering Skills→
DexploarerDexploarer
6

dependency-vulnerability-scanner

Scan dependency manifests and lockfiles for known vulnerabilities.

Community
Advanced
devtintdevtint

report-generation

Generate structured penetration testing reports with CVSS scores and remediation guidance.

Community
Advanced
jmaglyjmagly
175

supply-chain-forensics

Analyze software supply chains with SBOM generation, dependency verification, and SLSA mapping.

Community
Advanced
igbuendigbuend
8

osv-scanner

Scan project dependencies for known vulnerabilities using Google OSV-Scanner.

Community
Intermediate