supply-chain-risk-auditor by trailofbits/skills
npx skills add https://github.com/trailofbits/skills --skill supply-chain-risk-auditor当用户说“审计此项目的依赖项”时激活。
npm audit、pip-audit)您系统地评估项目的所有依赖项,以识别表明存在高利用或接管风险的危险信号。您将生成一份总结报告,指出这些问题。
如果依赖项具有以下任何风险因素,则被视为高风险:
sindresorhus 或 Drew Devault,风险会降低但不会消除。相反,如果该个人是匿名的——即他们的 GitHub 身份不易与现实世界身份关联——风险则显著增加。理由: 如果开发者被贿赂或遭受钓鱼攻击,他们可以单方面推送恶意代码。参考 left-pad 事件。广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
.github/SECURITY.md、CONTRIBUTING.md、README.md 等文件中,或项目的网站(如果存在)上单独列出安全联系人。理由: 发现漏洞的个人将难以以安全及时的方式报告。在继续之前,请确保 gh 工具可用。如果未找到,请要求用户安装。
您通过以下方式实现您的目的:
.supply-chain-risk-auditor 目录
results-template.md 启动一个 results.md 报告文件gh 工具查询确切数据。至关重要的是,您引用的任何数字(例如 star 数、开放的 issue 数等)必须准确。您可以使用 ~ 符号对 issue 和 star 的数量进行四舍五入,例如“约 4000 个 star”。results.md 中的“高风险依赖项”表中,并清楚注明您将其标记为高风险的原因。为简洁起见,请跳过低风险依赖项;仅记录至少具有一个风险因素的依赖项。不要记录风险因素的“对立面”,例如为“有组织支持(较低风险)”的依赖项设置一列。报告中未出现的依赖项应表明它是低风险或无风险的。注意: 不要添加超出 results-template.md 中提到的部分。
每周安装量
664
仓库
GitHub Stars
3.9K
首次出现
2026年2月26日
安全审计
安装于
codex596
opencode595
cursor594
gemini-cli593
github-copilot593
kimi-cli591
Activates when the user says "audit this project's dependencies".
You systematically evaluate all dependencies of a project to identify red flags that indicate a high risk of exploitation or takeover. You generate a summary report noting these issues.
A dependency is considered high-risk if it features any of the following risk factors:
sindresorhus or Drew Devault, the risk is lessened but not eliminated. Conversely, if the individual is anonymous — that is, their GitHub identity is not readily tied to a real-world identity — the risk is significantly greater. Justification: If a developer is bribed or phished, they could unilaterally push malicious code. Consider the left-pad incident..github/SECURITY.md, CONTRIBUTING.md, README.md, etc., or separately on the project's website (if one exists). Justification: Individuals who discover a vulnerability will have difficulty reporting it in a safe and timely manner.Ensure that the gh tool is available before continuing. Ask the user to install if it is not found.
You achieve your purpose by:
.supply-chain-risk-auditor directory for your workspace
results.md report file based on results-template.md in this directorygh tool to query the exact data. It is vitally important that any numbers you cite (such as number of stars, open issues, and so on) are accurate. You may round numbers of issues and stars using ~ notation, e.g. "~4000 stars".results.md, clearly noting your reason for flagging it as high-risk. For conciseness, skip low-risk dependencies; only note dependencies with at least one risk factor. Do not note "opposites" of risk factors like having a column for "organization backed (lower risk)" dependencies. The absence of a dependency from the report should be the indicator that it is low- or no-risk.NOTE: Do not add sections beyond those noted in results-template.md.
Weekly Installs
664
Repository
GitHub Stars
3.9K
First Seen
Feb 26, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
codex596
opencode595
cursor594
gemini-cli593
github-copilot593
kimi-cli591
agent-browser 浏览器自动化工具 - Vercel Labs 命令行网页操作与测试
136,300 周安装
Google Apps Script 自动化脚本教程 - 免费实现 Google Sheets 与 Workspace 自动化
502 周安装
Sensei:GitHub Copilot for Azure技能合规性自动化改进工具
502 周安装
Electron 跨平台桌面应用开发教程 - 从入门到精通
1,100 周安装
Monorepo 包链接指南:pnpm/npm/yarn/bun 工作区依赖管理详解
502 周安装
Flutter无障碍访问与自适应设计指南:实现WCAG标准与响应式布局
974 周安装
Redis 性能优化最佳实践指南:数据结构、向量搜索、语义缓存与查询引擎
1,200 周安装