ptn1411/skill/sbom-supply-chain-auditor

Claude Code and agent skill by ptn1411/skill

Trust tier 2
  • community
LLM review pending
Source check pending

Checking that the SKILL.md file is still in the repository.

Audit dependency manifests and lockfiles for SBOM extraction, risky install scripts, unpinned versions, remote/git dependency sources, dependency-confusion and typosquat/known-malicious package names, lockfile integrity gaps, copyleft license risk, and secret-like values.

Install

npx vskill@latest install ptn1411/skill/sbom-supply-chain-auditor

SKILL.md

SBOM Supply Chain Auditor

Purpose

Use after source recovery or on application repos to identify dependency and supply-chain risks.

Workflow

  1. Run python sbom-supply-chain-auditor/scripts/analyze_supply_chain.py <target> --out output/sbom-supply-chain-auditor.
  2. Review findings.json and REPORT.md.
  3. Use findings to prioritize dependency pinning, secret rotation, and package trust review.

Coverage

  • Install-time execution — npm preinstall/install/postinstall/prepare scripts.
  • Version hygiene — floating/unpinned npm & Python versions; file: local deps.
  • Remote sources — git+/http(s) deps (high unless pinned to a commit hash).
  • Dependency confusion — scoped @scope/pkg that may resolve from the public registry.
  • Typosquat / malware — names one edit from popular packages, and a curated known-malicious list (critical).
  • Lockfile integrity — package-lock.json entries missing integrity hashes.
  • License risk — missing license, or copyleft/restrictive (AGPL/GPL/SSPL/UNLICENSED).
  • Secrets — password/token/secret-like values in manifests.
Heuristic, not a CVE feed. Typosquat/known-malicious lists are a curated subset — pair with a vulnerability database for full coverage.

Outputs

  • findings.json
  • REPORT.md

Anti-Patterns

  • Do not claim CVE coverage without integrating a vulnerability database.
  • Do not auto-update dependencies from this skill.

Security

  • Security scanPassed, 100 of 100Pattern checks on the skill's files.
  • Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

Repository stars
150
Repository forks
90
7-day trend score
25

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/ptn1411/skill/sbom-supply-chain-auditor/badge)](https://verified-skill.com/skills/ptn1411/skill/sbom-supply-chain-auditor)

Something wrong with this skill or its page? Tell us.