Supply Chain Risk Auditor

What it does

This source separates collecting dependency evidence from interpreting it. It describes deterministic collectors for direct dependencies and lockfile-resolved packages, with explicit handling of data that could not be assessed. This is useful when a report would otherwise turn incomplete measurements into an unjustified clean or risky verdict.

Best for

Reviewing a dependency tree before adopting a project, investigating third-party package exposure or preparing a focused supply-chain assessment. Supply the actual manifest and lockfile rather than a list of package names without resolved versions.

Tradeoffs and requirements

The supporting collectors are executable code and may make network requests; this catalog has not run or audited them. Advisory coverage varies by ecosystem, and an archived upstream does not by itself demonstrate an exploitable defect. Missing evidence should remain unassessable rather than being converted into a positive or negative claim.

Unknown; inspect source requirements and supporting scripts.

Install from the source

Inspect the pinned source snapshot and its supporting files first. The command selects this skill through the open-source skills CLI. Node.js and agent-specific setup may be required. Installation can download code. Catalog ingestion never executes skill instructions or install scripts.

npx skills add https://github.com/trailofbits/skills/tree/2be6433b39e009cd2b6fd3be1895f6b1faa5af9a/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor --skill supply-chain-risk-auditor

Review pinned skill folder ↗ · CLI documentation ↗

After source review, use npx skills check and npx skills update to inspect and apply upstream updates. Re-check changed instructions before running them.

Safety & review signals

Static review only. This is not a security audit or a guarantee of safety.

SKILL.md text only; scripts, dependencies and runtime behavior not audited.

No configured text patterns matched. Unmatched or concealed behavior can still exist.

Allowed tools declaration: Read Write Bash Glob Grep. Runtime permissions and network behavior: Unknown.

AI Craft Pad Skill Score

86/100 · Metadata coverage 100% · Model 1.0

Scores summarize observable discovery signals. Popularity and repository activity apply to the whole repository. Unknown runtime safety earns no certification.

Documentation

100/100

100

Maintenance

100/100

100

License Clarity

100/100

100

Repository Health

100/100

100

Compatibility Evidence

80/100

80

Popularity

70/100

70

Originality

80/100

80

Static Safety

60/100

60

Suggested workflow

Inspect the collectors and required access, collect version-specific evidence in a controlled review environment, then prioritize findings according to the application's actual exposure. Keep package installation separate from metadata inspection.

How to judge the result

Verify package identities and resolved versions, document failed measurements and reproduce important findings against the relevant source. Confirm that recommendations address a real dependency path used by the application.