supply-chain-investigation

Analyze package manifests and CI logs to detect compromised software versions.

6|Updated Feb 13, 2026

Search Tags:#vulnerability analysis #malware detection #supply-chain security #CI log analysis #ecosystem support

Ready to run

npx skills add https://github.com/damianpapadopoulos/auto-claude-skills --skill supply-chain-investigation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supply-chain-investigation
Source: https://github.com/damianpapadopoulos/auto-claude-skills/tree/main/skills/supply-chain-investigation
Command: npx skills add https://github.com/damianpapadopoulos/auto-claude-skills --skill supply-chain-investigation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill streamlines the process of investigating potential supply-chain attacks on software packages, providing a comprehensive audit and helping to identify compromised versions and related risks.

Core Features & Use Cases

Attack Detection: Identifies potential supply-chain attacks based on trigger patterns and advisory-driven audits.
Ecosystem-specific Analysis: Supports npm, Maven, PyPI, Go, and Gradle ecosystems with tailored analysis for each.
Workflow Automation: Orchestrates a workflow for parsing advisories, scanning the organization's repositories, and classifying the severity of the threat.
CI Log Analysis: Forensically examines CI logs to detect malicious activities after a known compromise timestamp.
Verdict Generation: Provides a detailed verdict for each repository, summarizing the findings and risks.

Quick Start

To investigate a potential supply-chain attack, use the skill with the following command: 'supply-chain-investigation -a "GHSA-XXXX"'

Frequently Asked Questions about supply-chain-investigation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I investigate a potential supply-chain attack on a software package?▼

You investigate a supply-chain attack by parsing package manifests and CI logs to identify compromised versions. This Skill automates scanning your repositories and classifying threat severity based on specific advisory triggers.

Can I scan CI logs for malicious activity after a package compromise?▼

Yes, you can forensically examine CI logs to detect malicious activities that occurred after a known compromise timestamp. This helps identify if the supply-chain attack impacted your specific continuous integration workflows.

Does this supply-chain security audit support both npm and Maven ecosystems?▼

Yes, the security audit supports npm, Maven, PyPI, Go, and Gradle ecosystems. It applies tailored analysis patterns for each ecosystem to accurately parse manifests and lockfiles during the investigation.

What do I need to conduct an advisory-driven security audit across my repositories?▼

You need the `gh` CLI to conduct an advisory-driven security audit across your repositories. The Skill parses advisories, scans organization repositories, and generates a detailed verdict summarizing findings and risks.

How do I automate vulnerability analysis for a specific GitHub advisory?▼

You automate vulnerability analysis by running the Skill with a specific advisory identifier, such as 'supply-chain-investigation -a "GHSA-XXXX"'. This triggers a comprehensive scan and risk classification for your repositories.

What is the best way to generate a risk verdict for repositories affected by a compromised package?▼

The best way to generate a risk verdict is using this Skill to orchestrate repository scanning and CI log analysis. It provides a detailed verdict for each repository, summarizing the specific findings and associated supply-chain risks.