What problem does it solve?
It reduces the risk of supply-chain compromises by helping you identify vulnerable or non-compliant dependencies before they reach production.
Core Features & Use Cases
- CVE scanning across common ecosystems: Use language-specific security tooling (e.g., govulncheck, cargo audit, pip-audit) to find known vulnerabilities in dependency graphs.
- SBOM generation for traceability: Produce CycloneDX-compatible SBOMs so you can track direct and transitive components across releases.
- License compliance review and enforcement: Classify licenses by risk (permissive to copyleft) and help automate allowlist/denylist checks in CI.
- Dependency pinning and artifact verification guidance: Ensure lockfiles and integrity hashes are used to prevent tampering and reduce surprise upgrades.
- Use Case: Prepare a release candidate by verifying that all dependencies are pinned, scanning for critical CVEs, generating an SBOM for downstream auditing, and failing CI if disallowed licenses are detected.
Quick Start
Use the supply-chain-security skill to scan your project dependencies, generate an SBOM, and confirm license compliance for your next release.
