Supply Chain Risk Auditor

Supply Chain Risk Auditor is a Trail of Bits skill (publisher trailofbits, CC-BY-SA-4.0) that produces a supply-chain risk report for a project's direct npm, PyPI and Go dependencies, plus an advisory sweep of everything the lockfile resolves. It checks version-matched advisories, abandoned or archived upstreams, npm publisher concentration and install-time script execution. Two bundled Python scripts do the measuring (collect.py, then render.py), because the skill states that hand-collected maintainer and download figures were wrong before; the agent is told never to estimate these from memory or web search. Two rules are enforced: unavailable data is never evidence of risk, and an absent measurement is never a clean verdict. The agent then adds judgment clearly separated from measurement: upgrade paths, verified replacement candidates and whether npm ci --ignore-scripts is viable, written in an impersonal security-report register.

Use it before an engagement or when assessing third-party package risk. It does not audit licences, scan your own source for vulnerabilities, install or build anything, or cover ecosystems beyond npm, PyPI and Go. It notes that yarn.lock, pnpm-lock.yaml and poetry.lock are not read.

This skill is for coding agents such as Claude Code. Its value depends on the bundled scripts, which BusinessMCP does not run; an imported copy is instructions only.