supply-chain-investigation

You investigate a supply-chain attack by parsing package manifests and CI logs to identify compromised versions. This Skill automates scanning your repositories and classifying threat severity based on specific advisory triggers.

Yes, you can forensically examine CI logs to detect malicious activities that occurred after a known compromise timestamp. This helps identify if the supply-chain attack impacted your specific continuous integration workflows.

Yes, the security audit supports npm, Maven, PyPI, Go, and Gradle ecosystems. It applies tailored analysis patterns for each ecosystem to accurately parse manifests and lockfiles during the investigation.

You need the `gh` CLI to conduct an advisory-driven security audit across your repositories. The Skill parses advisories, scans organization repositories, and generates a detailed verdict summarizing findings and risks.

You automate vulnerability analysis by running the Skill with a specific advisory identifier, such as 'supply-chain-investigation -a "GHSA-XXXX"'. This triggers a comprehensive scan and risk classification for your repositories.

The best way to generate a risk verdict is using this Skill to orchestrate repository scanning and CI log analysis. It provides a detailed verdict for each repository, summarizing the specific findings and associated supply-chain risks.