Use This Skillsupply-chain-risk-auditor
Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-party package risk, or review a dependency tree before an engagement.
npx degit trailofbits/skills/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor .claude/skills/supply-chain-risk-auditorRead this skill at its source
The repo doesn’t state an open license, so we link to it rather than showing the text here.
Open on GitHub