Supply chain risk auditor
Audits dependencies and their provenance for supply-chain risk.
Installation
$ npx skills add trailofbits/skillsThe CLI's unit is the repository, so this installs everything in trailofbits/skills, not supply-chain-risk-auditor alone. It writes into whichever agent directories it finds — Claude Code, Codex, Cursor, Copilot, Windsurf, Zed.
Summary
Audits dependencies and their provenance for supply-chain risk.
- Reach for it when a release with new third-party dependencies, or a periodic sweep of what you already ship.
- Spans Secure and Ship, so it is usually worth loading for the whole piece of work rather than at one moment in it.
- Stack-agnostic — nothing in it assumes a particular language or framework.
- Published by Trail of Bits. Well regarded, but not the vendor of the thing it covers.
- Installing pulls the whole trailofbits/skills repository: this catalogue lists 12 other entries from it, and the repo may hold more.
Where it sits in delivery
SecureThreat modelling, scanning, supply chain, and finding the other five copies of the bug you just found.Everything in Secure →
ShipBranches, pipelines, releases and the deploy itself.Everything in Ship →
The agent itself
The full text lives with its publisher and changes when they change it. Read it there rather than here — a mirrored copy of somebody else's procedure goes stale silently, and this page would have no way of telling you.
Related
More in Secure
- Address PR commentsWorks through review comments on a pull request and responds to or resolves each one.
openai/skills - Deploy to VercelTakes a project from local to a live Vercel deployment.
vercel-labs/agent-skills - Fix CIReads a failing CI run, reproduces the failure and pushes the fix.
openai/skills - Security threat modelProduces a threat model for a feature or system — assets, entry points, trust boundaries, mitigations.
openai/skills - Secure workflow guideHardening CI: pinned actions, scoped tokens, and the injection paths in a pull_request_target trigger.Skill
trailofbits/skills - Agentic actions auditorAudits CI workflows that invoke AI agents — where prompt injection becomes a repository write.
trailofbits/skills