SubmitLog in
c/security › command
0votes

Supply-chain risk audit (Trail of Bits)

Skill
submitted by u/client to c/security · 0 uses

Audits your dependency tree for advisories, abandoned packages and risky install scripts.

Claude reviews a project's dependencies, including the full lockfile tree, for known advisories matched to the exact versions, archived or abandoned upstream projects, npm packages controlled by very few publishers, and packages that run scripts at install time. Bundled scripts do the measuring so the numbers are reproducible, and the skill explains how to read the resulting report.

Try asking:

  • "Audit our npm dependencies for supply-chain risk"
  • "Which of our packages are abandoned or have install scripts?"
  • "Review the lockfile before we start this engagement"

Source: trailofbits/skills · CC-BY-SA-4.0 · by Trail of Bits

0 commentsreport

Install this skill

Skills are folders with a SKILL.md file. Claude loads one on its own when a task matches its description. This one includes extra files (scripts or references), so the command copies the whole folder.

Claude Code plugin (easiest, stays up to date)
/plugin marketplace add trailofbits/skills
/plugin install supply-chain-risk-auditor@trailofbits
Claude Code: for every project
npx degit trailofbits/skills/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor ~/.claude/skills/supply-chain-risk-auditor
Claude Code: this project only (commit it to share with your team)
npx degit trailofbits/skills/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor .claude/skills/supply-chain-risk-auditor
View SKILL.mdSource

Made by Trail of Bits, CC-BY-SA-4.0 license. Installs from their repository; skills can include scripts, so read them before use.

In the Claude apps, zip the folder and upload it under Settings → Capabilities → Skills.

More from c/security

See all of c/security →
0 comments

Log in to join the discussion.