# supply-chain-risk-auditor

Audit a project's npm, PyPI, and Go dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned upstreams, npm publisher concentration, and install scripts

- **Kind:** plugin (installs as one bundle)
- **Owner:** trailofbits
- **Source:** https://github.com/trailofbits/skills (`plugins/supply-chain-risk-auditor`)
- **Pinned commit:** `d3323cefbcf645678b8dc481de204b02ad3d02dc`
- **Page:** https://forefy.com/plugins/24cb9085-f67b-5595-a527-69a2c1f24796
- **API (JSON):** https://forefy.com/api/asr/plugins/24cb9085-f67b-5595-a527-69a2c1f24796

## Install

Ask your agent: `Install the supply-chain-risk-auditor plugin securely from: https://forefy.com/plugins/24cb9085-f67b-5595-a527-69a2c1f24796 globally to ~/.claude/skills`

Or run the pinned install script: `curl -fsSL https://forefy.com/api/asr/plugins/24cb9085-f67b-5595-a527-69a2c1f24796/install | bash` (`?location=project` for the current project, `&shell=powershell` with `irm ... | iex`; `harness=agents` prints the Codex commands).

## Skills in this plugin (1)

- [supply-chain-risk-auditor](https://forefy.com/skills/7c2f5b50-4e0b-4228-ab1c-1b599957dc5c): Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived ups…