supply-chain-risk-auditor
trailofbits7.2k installs
Find supply-chain risks in your dependencies.
What it does
Produces a dependency supply-chain risk report with measured findings and prioritized remediation advice.
When to use it
Use when asked to audit dependencies, assess supply-chain or third-party package risk, or review a dependency tree before an engagement.
How to use it
Give it a project to audit; it saves a Markdown risk report and supporting JSON outside the repository unless directed otherwise.
What you provide
- An existing project
Uses
OS
DD
OS
Latest review
What you need · 5
The collector requires Python 3.11 or later.
The prescribed workflow uses uv to run the collector and report renderer.
Access · 8
This skill
OSV
Read
Looks up dependency advisories
GitHub
Read
Reads upstream repository metadata