supply-chain-security-reviewer

What problem does it solve?

This Skill helps you assess whether software can be compromised through its dependencies, build process, or CI/CD pipeline, rather than only through first-party code vulnerabilities.

Core Features & Use Cases

• Dependency Risk Review: Triage lockfiles and scanner output by reachability, so reachable issues are separated from latent or irrelevant findings.
• Build and CI Security Review: Inspect install scripts, postinstall hooks, GitHub Actions, and other pipeline steps for untrusted triggers, secret exposure, and unpinned third-party actions.
• Provenance and Pinning Checks: Evaluate whether packages, artifacts, models, datasets, and agentic components are pinned, sourced safely, and accompanied by trustworthy integrity signals.
• Use Case: A team preparing to publish a repository can use this Skill to identify the dependency, workflow, or artifact paths that could lead to code execution or secret theft.

Quick Start

Ask the supply-chain security reviewer to inspect the repository’s lockfiles, install scripts, and CI workflows for reachable compromise paths and concrete remediation steps.