supply-chain-dependencies

Analyze dependency manifests and lockfiles for known vulnerabilities and maintenance risks.

Updated Jul 30, 2026

Search Tags:#security #vulnerability #dependencies #audit #compliance #supply-chain

Ready to run

npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill supply-chain-dependencies

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supply-chain-dependencies
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/supply-chain-dependencies
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill supply-chain-dependencies

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the critical security gap of hidden vulnerabilities and maintenance risks within application dependency trees, preventing the accidental inclusion of compromised or unmaintained code.

Core Features & Use Cases

Vulnerability Identification: Cross-references manifests and lockfiles against databases like GHSA and NVD to flag known CVEs.
Hygiene Assessment: Detects unpinned version ranges, end-of-life frameworks, and potential dependency confusion candidates.
Use Case: Before a production release, use this skill to generate a comprehensive risk matrix of all direct and transitive dependencies to ensure compliance with organizational security policies.

Quick Start

Use the supply-chain-dependencies skill to perform a full security audit on the package manifests and lockfiles located in the current project directory.

Frequently Asked Questions about supply-chain-dependencies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit dependency vulnerabilities in Node.js and Python projects?▼

To audit dependency vulnerabilities, you analyze application manifests and lockfiles against advisory databases like GHSA and NVD. This process flags known CVEs across ecosystems including Node.js and Python, providing actionable remediation paths without executing your codebase.

What is supply-chain hygiene and how does it affect dependency security?▼

Supply-chain hygiene involves assessing dependencies for unpinned version ranges, end-of-life frameworks, and dependency confusion candidates. Evaluating these risks prevents the accidental inclusion of compromised or unmaintained code within your application's dependency tree.

Can I check lockfiles for known CVEs across Rust and Go ecosystems?▼

Yes, you can check lockfiles for known CVEs across Rust and Go ecosystems. The static analysis cross-references your dependency files against vulnerability databases to identify security risks and generate a comprehensive risk matrix for direct and transitive dependencies.

What's the best way to generate a compliance risk matrix for production releases?▼

The best way to generate a compliance risk matrix is performing a full security audit on package manifests and lockfiles before production release. This identifies maintenance risks and supply-chain integrity issues, ensuring compliance with organizational security policies.

Does dependency vulnerability analysis modify or execute my target codebase?▼

Dependency vulnerability analysis does not modify or execute your target codebase. It requires only static analysis of dependency files against advisory databases, ensuring your application code remains untouched while identifying hidden vulnerabilities and maintenance risks.

Why do I need to analyze transitive dependencies for security compliance?▼

You need to analyze transitive dependencies because hidden vulnerabilities often exist deep within the dependency tree. Static analysis of lockfiles identifies unmaintained or compromised code introduced indirectly, preventing security policy violations before production deployment.