supply-chain-risk-auditor

To audit project dependencies for supply chain risks, this skill systematically evaluates factors like maintainer count, project activity, and past CVEs to identify vulnerable libraries and generate a detailed risk report.

An open source dependency is high risk for exploitation if it has a single maintainer, unmaintained status, low popularity, past CVEs, or lacks a security contact, which this skill analyzes to flag potential vulnerabilities.

To find safer alternative libraries for vulnerable dependencies, this skill evaluates your current packages against defined risk criteria and suggests alternative libraries in a structured summary report.

Yes, you need the 'gh' tool installed to perform a dependency vulnerability management assessment, because this skill requires it to query GitHub repository data for evaluating project activity and maintainer count.

You should run a supply chain security audit on your project before integrating a new library into critical infrastructure, proactively identifying potential single maintainer vulnerabilities or unmaintained packages.

Yes, you can check if a dependency is unmaintained or has feature risks by running this skill, which queries GitHub repository data to evaluate project activity, maintainer count, and security contact availability.