supply-chain-risk-auditor

Name: supply-chain-risk-auditor
Availability: InStock
Author: manuelbrandner85

Evaluate software dependencies for maintainer activity, popularity, and security posture.

Updated Nov 23, 2025

Search Tags:#security #github #dependencies #audit #risk-assessment #supply-chain

Ready to run

npx skills add https://github.com/manuelbrandner85/Weltenbibliothekapp --skill supply-chain-risk-auditor-manuelbrandner85

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supply-chain-risk-auditor
Source: https://github.com/manuelbrandner85/Weltenbibliothekapp/tree/main/.agents/skills/supply-chain-risk-auditor
Command: npx skills add https://github.com/manuelbrandner85/Weltenbibliothekapp --skill supply-chain-risk-auditor-manuelbrandner85

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the security blind spots in software projects by identifying dependencies that are unmaintained, lack security oversight, or exhibit high-risk characteristics prone to exploitation.

Core Features & Use Cases

Risk Assessment: Evaluates dependencies based on maintainer activity, popularity, and historical vulnerability data.
Security Reporting: Generates a structured audit report highlighting high-risk components and suggesting safer alternatives.
Use Case: Before starting a new security audit or onboarding a third-party library, use this Skill to ensure your project's supply chain is robust and not reliant on abandoned or vulnerable code.

Quick Start

Activate the supply chain risk auditor by instructing the assistant to audit this project's dependencies.

Frequently Asked Questions about supply-chain-risk-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit software dependencies for supply chain security risks?▼

To audit software dependencies for supply chain security risks, you can use a tool that evaluates maintainer activity, popularity, and security posture to generate a comprehensive risk report identifying vulnerable or unmaintained components.

Why do I need the GitHub CLI for dependency risk assessment?▼

You need the GitHub CLI for dependency risk assessment because the auditor queries repository metadata directly through the CLI to evaluate maintainer activity and historical vulnerability data for your project's dependencies.

What is the best way to check if a third-party library is unmaintained before onboarding?▼

The best way to check if a third-party library is unmaintained before onboarding is to run a supply chain risk evaluation that analyzes maintainer activity and security posture, highlighting high-risk components and suggesting safer alternatives.

Can I generate a security audit report for abandoned project dependencies?▼

Yes, you can generate a structured security audit report for abandoned project dependencies by evaluating their historical vulnerability data and maintainer popularity, which highlights high-risk code prone to exploitation.

Does a supply chain risk assessment work for evaluating third-party library health?▼

Yes, a supply chain risk assessment works for evaluating third-party library health by identifying dependencies that lack security oversight or exhibit high-risk characteristics, ensuring your project is not reliant on vulnerable code.

When should I not use an automated dependency health evaluation?▼

You should reconsider an automated dependency health evaluation if your project lacks integration with the GitHub CLI, as the assessment requires this tool to query repository metadata and generate accurate risk reports.