supply-chain-risk-auditor

Name: supply-chain-risk-auditor
Availability: InStock
Author: rohanbhatia27

Audit project dependencies for supply chain exploitation and takeover risks.

1|Updated Apr 7, 2026

Search Tags:#security #risk assessment #vulnerability management #dependency audit #supply chain

Ready to run

npx skills add https://github.com/rohanbhatia27/rohanstutoring-redesign --skill supply-chain-risk-auditor-rohanbhatia27

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supply-chain-risk-auditor
Source: https://github.com/rohanbhatia27/rohanstutoring-redesign/tree/main/.agents/skills/supply-chain-risk-auditor
Command: npx skills add https://github.com/rohanbhatia27/rohanstutoring-redesign --skill supply-chain-risk-auditor-rohanbhatia27

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill automates the identification of dependencies at heightened risk of exploitation or takeover, streamlining the assessment of your project's supply chain attack surface.

Core Features & Use Cases

Risk Identification: Automatically evaluates dependencies for risk factors such as single maintainers, unmaintained status, low popularity, high-risk features, past CVEs, and absence of security contact.
Dependency Audit: Generates a summary report noting issues with high-risk dependencies.
Use Case: Prior to a security audit, use this Skill to quickly identify and address potential vulnerabilities in your project's dependencies.

Quick Start

Run the supply-chain-risk-auditor skill to audit the dependencies of your project.

Frequently Asked Questions about supply-chain-risk-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit my project dependencies for supply chain security risks?▼

To audit dependencies for supply chain security risks, you can run an automated assessment that evaluates factors like single maintainers, unmaintained status, low popularity, and past CVEs. This generates a report highlighting high-risk dependencies.

What makes a dependency high-risk in a software supply chain?▼

A dependency is flagged as high-risk in a software supply chain when it exhibits vulnerabilities such as single maintainer status, unmaintained code, low popularity, high-risk features, past CVEs, or an absence of a security contact.

How can I identify unmaintained dependencies before a security audit?▼

You can identify unmaintained dependencies before a security audit by running an automated risk evaluation tool. It checks for unmaintained status, single maintainers, and missing security contacts, generating a summary report of vulnerable packages.

Do I need the gh tool to perform a dependency risk assessment?▼

Yes, you need the gh tool installed and authenticated to perform a dependency risk assessment. The audit requires gh to query GitHub data for evaluating risk factors like maintainer status, popularity, and past CVEs.

Can I generate a vulnerability report for dependencies with single maintainers?▼

Yes, you can generate a vulnerability report for dependencies with single maintainers. The assessment specifically evaluates maintainer count along with unmaintained status and past CVEs to produce a report on high-risk dependencies.