Socket SCA

This skill performs software composition analysis (SCA) for npm and pip projects using the Socket.dev socket CLI, identifying supply chain risks such as install-script abuse, typosquatting, obfuscated code, protestware, and malicious packages, then mapping findings to CWE and OWASP Top 10:2021 standards. Where the CLI is unavailable, ten structured manual checks provide partial coverage.

When to Use

• When the user asks to "scan dependencies for supply chain risks" or "run Socket"
• When the user mentions "SCA", "dependency audit", or "supply chain analysis"
• When reviewing package.json, package-lock.json, requirements.txt, or Pipfile before deployment
• When a pull request adds or upgrades dependencies and a security check is requested
• When the user asks to detect typosquatting, install scripts, or malicious packages
• When onboarding a third-party library and due diligence is needed
• When investigating a suspected compromised or protestware package

When NOT to Use