Supply Chain Security

Purpose

Enable Claude to assess and harden the software supply chain end-to-end: what a project depends on, how those dependencies got in, how they were built, and how anyone downstream can trust the result. This complements Skill 02 (Vulnerability Scanner) — Skill 02 asks "is this known-vulnerable version?"; this skill asks "is this dependency, build, or pipeline something to trust at all?"

Activation Triggers

This skill activates when the user asks about:

• SBOM (Software Bill of Materials) generation, validation, or analysis (CycloneDX, SPDX)
• Dependency confusion, typosquatting, or malicious/compromised packages (npm, PyPI, RubyGems, crates.io, Maven, Go modules)
• Suspicious postinstall/preinstall scripts or other package lifecycle hooks
• CI/CD pipeline security — GitHub Actions, GitLab CI, Jenkins hardening
• Artifact signing, provenance, or attestation — SLSA levels, in-toto, Sigstore/cosign, npm provenance
• Build reproducibility or "does this build match what's published" questions
• Vendor/open-source component risk as part of onboarding a new dependency
• Incidents referencing a compromised upstream package, maintainer account takeover, or a poisoned build pipeline