supply-chain-risk-auditor: Claude Code Skill & Agent Tool
An open-source skill by trailofbits (opens in a new tab), published in the trailofbits/skills (opens in a new tab) repository on GitHub. Audits every dependency in your lockfile for known advisories, abandoned or archived upstreams, publisher concentration and install-time scripts before they reach production.
Install supply-chain-risk-auditor
Requires Node.jsnpx skills add trailofbits/skills --skill supply-chain-risk-auditorRun this command in your project terminal to install this skill for Claude Code.
What this skill does
supply-chain-risk-auditor is Trail of Bits' skill for auditing a project's third-party dependencies before they become your problem. It looks at the direct dependencies and the full lockfile tree and reports version-matched security advisories, abandoned or archived upstream repositories, concentration of npm packages in the hands of few publishers, and packages that execute scripts at install time.
The skill is built so that scripts do the measuring and the agent does the interpreting: a collector gathers the facts, then a report is rendered, which keeps the numbers accurate and reproducible. It reads package.json, pyproject.toml, requirements files and go.mod, and uses package-lock.json, npm-shrinkwrap.json, uv.lock and go.mod for exact versions and the transitive sweep. When a lockfile it does not parse is present, such as yarn.lock or pnpm-lock.yaml, the report says so instead of guessing.
It checks whether the GitHub CLI is signed in, because unauthenticated requests are heavily rate-limited, and states clearly when repository criteria could not be assessed. Outputs are written outside the audited repository. Use it with Claude Code before adopting a new library, ahead of a security engagement, or as part of a release checklist.
Key Capabilities
- Version-matched advisories for direct dependencies and the full lockfile tree
- Flags abandoned or archived upstream repositories
- Measures npm publisher concentration and install-time scripts
- Reads npm, Python and Go manifests; unparsed lockfiles are reported, not guessed
- Scripts measure and the agent interprets, so the numbers are reproducible
How to use with Claude Code & AI Agents
Install the skill
Run the command above at the root of your project. The CLI asks which agents to set up — Claude Code, Cursor and other supported agents — and adds supply-chain-risk-auditor to the project, so teammates who pull the repository get it too. Add-gto install it for your user account across every project.Open a new agent session
Start a fresh Claude Code session in that project so the agent loads the new skill. Have ready: GitHub CLI signed in (recommended, avoids rate limits).Ask in plain words
Describe the task, for example:“Audit this project's dependencies for supply-chain risk before we ship.”The agent matches your request to the skill's description and follows its SKILL.md instructions step by step. Read them on GitHub before using the skill on a system that matters.