cali-ops-package-audit
Installation
SKILL.md
Supply Chain Security
Run before installing any package. Run again before every release.
Tool Selection
| Tool | Purpose | When |
|---|---|---|
| Socket.dev | Behavioral malware scanning | Before npm install, pip install |
| Trivy | CVE + IaC + secrets | Before releases, full audits |
| OSV-Scanner | Precision CVE (commit-hash) | When Trivy has false positives |
| dotenvx | Encrypted env vars | When managing .env files |
1. Socket.dev — Malware Detection
Detects obfuscated code, network access in install scripts, typosquatting.