Supply Chain Audit

Audits a project for the controls that block supply chain attacks — compromised packages, poisoned transitive dependencies, malicious post-install scripts, untrusted base images, hijacked GitHub Actions. Then proposes a layered remediation plan and applies it after explicit user approval.

The skill follows a strict four-phase workflow: detect → audit → plan → apply. Phase boundaries are gates the user crosses, not steps the agent powers through. Do not jump ahead.

When to use

• The user says "audit supply chain", "harden dependencies", "avoid supply chain attack", "lock down npm/pypi".
• The user mentions a recent attack (Axios, TanStack, ultralytics, etc.) and wants to defend against the next one.
• The user is preparing a project for production / public release and wants the dependency surface tightened.

Do not use this skill for:

• Runtime application vulnerabilities (use a SAST/DAST tool or code-review).
• Secret scanning in commits (different attack vector).
• Generic dependency updates without a security goal (use Renovate/Dependabot directly).
• Cloud infra hardening (IAM, network policies) — out of scope.