supply-chain-audit

To audit multi-language dependencies for supply-chain poisoning, the Skill scans project metadata and standard dependency files across Python, npm, Go, Rust, Ruby, Java, and PHP to detect backdoors and malicious hooks. It then generates a consolidated risk report with actionable remediation guidance.

Malicious npm install hooks and Python .pth poisoning are common supply-chain attack vectors that inject backdoors during package installation. The Skill detects these unsafe replaces and suspicious install hooks by applying language-specific static and dynamic checks to your dependency files.

Yes, you can check Rust build.rs and Go init backdoors in the same security audit. The Skill performs language-specific checks across Rust, Go, Ruby extconf.rb, and Java Maven/Gradle plugins, centralizing the results into a single structured audit report.

Yes, this dependency audit works for projects using multiple languages at once. It is designed for projects of all sizes facing dependency-related security concerns, aggregating risks from Python, npm, Go, Rust, Ruby, Java, and PHP into one centralized risk report.

To generate a consolidated dependency risk report, you need to provide access to your project metadata and standard dependency files. The Skill requires these inputs to detect backdoors, unsafe replaces, and suspicious install hooks across your multi-language codebase.