skills.rest
woohyun212
woohyun212COMMUNITY
Explore all skills by this author →
WebsiteGitHub

supply-chain-audit

Audit software supply chains with SCA scans, SLSA matrices, and SBOMs.

21|1|Updated Apr 12, 2026
Search Tags:#vulnerability#supply-chain#slsa#sbom#sca#dependency-audit
One-click install
npx skills add https://github.com/woohyun212/security-skill --skill supply-chain-audit-woohyun212
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-audit
Source: https://github.com/woohyun212/security-skill/tree/main/supply-chain-audit
Command: npx skills add https://github.com/woohyun212/security-skill --skill supply-chain-audit-woohyun212

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Organizations struggle to assess the security of their software supply chain, lacking automated tools to scan dependencies, evaluate SLSA compliance, and generate comprehensive SBOMs.

Core Features & Use Cases

  • Multi‑ecosystem SCA scanning with Trivy, Grype, and ecosystem‑specific tools such as npm audit, pip‑audit, and govulncheck.
  • SLSA compliance assessment providing a matrix and actionable quick‑wins for levels 1‑4.
  • SBOM generation in CycloneDX and SPDX formats via Syft, including container image inventories.
  • Attack surface analysis across dependency, build pipeline, source code, and distribution vectors.
  • Remediation roadmap with prioritized steps from immediate to long‑term.

Quick Start

Use the supply-chain-audit skill on your repository to generate a full audit report.

Frequently Asked Questions about supply-chain-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an SBOM for my software repository?▼

To generate an SBOM for your repository, you can use this skill to automate Syft, producing inventory outputs in CycloneDX or SPDX formats for your source code and container images.

What is SLSA compliance assessment and how does it evaluate my code?▼

SLSA compliance assessment evaluates your software supply chain security levels from 1 to 4, generating a compliance matrix and providing actionable quick-wins to improve build pipeline provenance.

Can I scan dependencies across multiple ecosystems like npm, pip, and Go?▼

Yes, you can scan dependencies across multiple ecosystems using Trivy, Grype, and ecosystem-specific tools like npm audit, pip-audit, and govulncheck to detect known vulnerabilities.

What is the best way to audit a software supply chain for vulnerabilities?▼

The best way to audit a software supply chain is running SCA scans and attack surface analysis across dependencies, build pipelines, source code, and distribution vectors to produce a prioritized remediation roadmap.

Does supply-chain-audit work with Trivy, Grype, and Syft for vulnerability detection?▼

Yes, supply-chain-audit integrates directly with Trivy, Grype, and Syft to execute SCA scanning, detect dependency risks, and generate SBOMs in CycloneDX and SPDX formats.

How do I assess SLSA levels and get a remediation roadmap for my build pipeline?▼

You can assess SLSA levels by auditing your build pipeline provenance, which yields a compliance matrix and a prioritized remediation roadmap ranging from immediate quick-wins to long-term steps.

Related Skills

Explore More Software Engineering Skills→
williamzujkowskiwilliamzujkowski
6

Software Supply Chain Security Validator

Generate SBOMs, scan dependencies, and validate SLSA provenance attestations.

Community
Advanced
Endor-Solutions-ArchitectureEndor-Solutions-Architecture
2

endor-sbom

Export, import, analyze, and compare CycloneDX or SPDX SBOMs.

Official
Advanced
ancolemanancoleman
503

managing-vulnerabilities

Automate multi-layer security scanning and SBOM generation in CI/CD pipelines.

Community
Advanced
RepairYourTechRepairYourTech
6

dependency-auditing

Automate dependency auditing for security vulnerabilities and license compliance.

Community
Advanced