dependency-security Skill

Goal

This skill secures the software supply chain.

Steps

1. Software Composition Analysis (SCA)

"You are what you import."

• Audit: Run npm audit / pip-audit / cargo audit in CI.
• Block: Fail the build on CRITICAL or HIGH vulnerabilities.
• Lock: Always verify lockfiles (package-lock.json) match package.json.

2. SBOM (Software Bill of Materials)

• Generate a list of all ingredients in your software.
• Tools: syft, cyclonedx-cli.
• Why? Rapid response when the next Log4Shell happens.