skills.rest
NOMARJ
NOMARJOFFICIAL
Explore all skills by this author →
WebsiteGitHub

supply-chain-audit

Audit project dependencies for supply-chain threats and classify findings by severity.

5|2|Updated Feb 15, 2026
Search Tags:#npm#vulnerabilities#cargo#supply-chain#typosquatting#pip-audit#dependency-audit
One-click install
npx skills add https://github.com/NOMARJ/sigil --skill supply-chain-audit-nomarj
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-audit
Source: https://github.com/NOMARJ/sigil/tree/main/packs/security/skills/owasp-security/supply-chain-audit
Command: npx skills add https://github.com/NOMARJ/sigil --skill supply-chain-audit-nomarj

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill audits project dependencies to detect supply-chain risks before they are introduced, preventing vulnerable or malicious packages from entering the codebase or CI pipeline.

Core Features & Use Cases

  • Automated vulnerability checks: Run vulnerability scanners and flag Critical, High, Medium, and Low findings with suggested fixes.
  • Health and hygiene signals: Evaluate maintenance status, maintainer count, download and usage statistics, license compatibility, version pinning, and lock file integrity.
  • Supply-chain attack detection: Identify typosquatting, dependency confusion risks, recent ownership changes, install scripts that execute code during install, transitive depth concerns, and unused or low-adoption packages.
  • Use Cases: Run on commits that modify package.json, requirements.txt, go.mod, or Cargo.toml, on pull requests that add dependencies, or as part of periodic dependency health reviews.

Quick Start

Audit changed dependency files and produce a supply chain risk report that lists critical and high findings with recommended remediations.

Frequently Asked Questions about supply-chain-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit npm and pip dependencies for supply-chain vulnerabilities?▼

To audit dependencies for supply-chain vulnerabilities, run automated scanners like npm audit, pip-audit, cargo audit, and govulncheck to flag Critical, High, Medium, and Low findings with suggested fixes.

What is typosquatting and dependency confusion in package registries?▼

Typosquatting and dependency confusion are supply-chain attacks where malicious packages mimic legitimate ones to infiltrate codebases. This Skill detects these risks by analyzing registry health signals, recent ownership changes, and transitive depth concerns.

Can I check dependency health signals like maintainer count and lockfile integrity?▼

Yes, you can evaluate dependency health and hygiene signals by assessing maintenance status, maintainer count, download statistics, license compatibility, version pinning, and lockfile integrity to ensure package safety.

How do I scan package.json and requirements.txt changes during pull request reviews?▼

To scan dependency file changes during pull request reviews, apply this audit to projects when package.json, requirements.txt, go.mod, or Cargo.toml are modified, producing a risk report with remediation recommendations.

Does the audit detect install scripts that execute code during package installation?▼

Yes, the supply-chain audit detects install scripts that execute code during installation. It also identifies unused or low-adoption packages and classifies all findings by severity to prevent malicious packages from entering the CI pipeline.

Related Skills

Explore More Software Engineering Skills→
gaiastudio-aigaiastudio-ai
2

gaia-review-deps

Audit project dependencies for CVEs, outdated versions, and license conflicts.

Official
Advanced
jpoleyjpoley
50

security-fixer

Generate secure patches for code vulnerabilities and output unified diffs.

Community
Intermediate
qte77qte77
2

scanning-dependencies

Scan project dependencies for vulnerabilities, license issues, and supply chain risks.

Community
Intermediate
nimadorostkarnimadorostkar
25

supply-chain

Audit dependency trees and harden CI/CD pipeline configurations.

Community
Advanced