supply-chain-security
Installation
SKILL.md
Supply Chain Security
Rank by reachability, not CVSS
CVSS describes a vulnerability in the abstract. Reachability describes your exposure. A critical CVE in a package whose vulnerable function you never call is a batch-with-the-next-upgrade item. A medium CVE on your auth path is not.
| Tier | Definition |
|---|---|
| Reachable — exposed | A call path exists from a network-facing entry point to the vulnerable symbol |
| Reachable — internal | A path exists from internal or CLI entry points only |
| Present, unreachable | Installed; the vulnerable symbol is never called |
| Dev-only | devDependencies — not shipped, still in the CI supply chain |
| Transitive, unreachable | Pulled in by another package, never invoked |
Print the path. The ranking is only trustworthy if it is auditable: