domains / security / supply-chain-dependency-audit / supply-chain-risk-auditor

supply-chain-risk-auditor

Skill card

combined

The two copies describe different procedures for the same task. The trailofbits copy is a deterministic, script-driven audit that forbids manual estimation, enforces a strict 'unassessable is not risk' epistemology, and produces a rendered report from a collector. The sickn33 copy is a manual, judgment-driven audit that explicitly requires using `gh` to count stars and issues, applies subjective risk criteria (e.g., maintainer anonymity, low popularity), and produces a narrative report with suggested alternatives. They disagree on the core methodology (scripts vs. manual `gh` queries) and the definition of risk (measured criteria vs. qualitative red flags). Crowning one would hide a valid alternative approach to supply chain auditing.

Repositories

Other copies

Combined skill

---
name: supply-chain-risk-auditor
description: "Audits a project's dependencies for supply-chain risk using either deterministic script-based measurement or manual judgment-based assessment. Use when asked to audit dependencies, assess supply-chain risk, or review a dependency tree."
allowed-tools: Read Write Bash Glob Grep
---

# Supply Chain Risk Auditor

This skill supports two distinct approaches to supply chain risk auditing. Choose the approach based on the user's preference or the available tooling.

## Approach A: Deterministic Script-Based Audit (Preferred for Reproducibility)

Use this approach when exact, reproducible measurements are required and the `uv` runtime is available.

1. **Confirm Manifests:** Verify the target directory has `package.json`, `pyproject.toml`, `requirements*.txt`, or `go.mod`. If none exist, stop.
2. **Check Auth:** Run `gh auth status`. Unauthenticated GitHub limits may cause criteria to be 'unassessable'.
3. **Collect Data:** Run the collector script:
   ```sh
   uv run {baseDir}/scripts/collect.py <project-dir> --json <out-dir>/findings.json
   ```
4. **Render Report:** Run the renderer script:
   ```sh
   uv run {baseDir}/scripts/render.py <out-dir>/findings.json --out <out-dir>/report.md
   ```
5. **Interpret:** Read `report.md`. Remember that 'unassessable' is not risk. Add a short narrative for the reader, upgrade paths, and replacement candidates (labeled as judgment).

## Approach B: Manual Judgment-Based Audit (Preferred for Qualitative Risk)

Use this approach when qualitative risk factors (e.g., maintainer anonymity, low popularity) are the primary concern.

1. **Setup:** Create a `.supply-chain-risk-auditor` directory and initialize `results.md` from a template.
2. **Identify Repos:** Find git repositories for all direct dependencies.
3. **Evaluate Risk:** For each dependency, use `gh` to query stars, issues, and maintainer info. Assess against these criteria:
   - **Single Maintainer:** Is it maintained by an individual or small team? Is the maintainer anonymous?
   - **Unmaintained:** Is the project stale, deprecated, or ignoring security issues?
   - **Low Popularity:** Are stars/downloads low compared to other dependencies?
   - **High-Risk Features:** Does it use FFI, deserialization, or third-party code execution?
   - **Past CVEs:** Are there high/critical severity CVEs?
   - **No Security Contact:** Is there no `SECURITY.md` or similar?
4. **Report:** Add high-risk dependencies to the report with justifications. Suggest alternatives for each.

## Conflicts
- **Data Source:** Approach A forbids manual `gh` queries for metrics; Approach B requires them.
- **Risk Definition:** Approach A treats missing data as 'unassessable' (not risk); Approach B treats low popularity or missing security contacts as risk factors.
- **Output:** Approach A produces a factual, script-rendered report; Approach B produces a narrative report with subjective justifications.