node-supply-chain
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a repository auditing tool focusing on supply chain security.
- The included Python script
audit_supply_chain.pyperforms static analysis of configuration files (e.g.,package.json,.github/workflows/*.yml) using regular expressions. It does not invoke subshells, execute dynamic code, or initiate network requests. - External references in the
supply-chain-playbook.mdtarget official documentation and well-known security resources, including GitHub, npmjs.com, pnpm.io, and CISA.gov. - The skill instructions encourage secure practices such as SHA-pinning for GitHub Actions and frozen-lockfile installs in CI pipelines.
- No evidence of prompt injection, credential harvesting, or malicious persistence mechanisms was identified.
Audit Metadata