Individual skill
auditing-supply-chain
Audit software supply chain risk — dependency and transitive package review, typosquatting and dependency confusion, lockfile and SBOM analysis, CI/CD pipeline and GitHub Actions security, build provenance, and secrets exposure. Use when assessing third-party package risk, reviewing a build pipeline, investigating a malicious package, or hardening release infrastructure.
secskills-core/skills/auditing-supply-chain/SKILL.md
Source commit ca53957bcd8e3b83b5d4d190bb3ad008a4f15c84
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 188
- Repository last updated
- Sep 4, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- security Repository topic
- skills Repository topic
- devops Derived category
- security Derived category
- engineering Derived category
- operations Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytesSKILL.mdcore · 13,133 bytes
Read excerpt
# Auditing Supply Chain
Your build pipeline runs more untrusted code than your application does. A
single unpinned action, a postinstall script, or a workflow with a writable
token is a path from a stranger's commit to your production artifacts and
your signing keys.
## When to Use
- Assessing risk from third-party dependencies in an application
- Reviewing CI/CD pipelines, GitHub Actions, and release automation
- Investigating a suspicious or malicious package
- Producing or reviewing an SBOM
- Hardening build provenance and artifact signing