Identifies dependencies at heightened risk of exploitation or takeover.
SkillScore77Maintained
Automatic
◆Security & AppSec pack
Last verified 8/19/2026
What it changes
Passed 16 of 21 test cases with the skill, and 12 of 21 without it.
Without skill59%
With skill77%
Checks it passed that the model alone missed
Flags packages as unmaintained only if bugs or security issues remain unaddressed.
Advises using runtime security APM or sandboxing tools for live execution monitoring.
Clarifies that license compliance auditing is outside the scope of supply chain maintainer risk auditing.
and 2 more in the full report
4 fixed13 passed either way5 still failing0 broke
Pass-rate lift
+18 pp
Tokens
-7%
Agent turns
0%
Response time
-61%
Model gemini-3.6-flashMeasured 8/19/2026v117 of 22 cases passed with skill · 21 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 4
Prompt
We evaluated 50 direct dependencies and found that 42 of them have no high-risk flags. Should we include all 42 low-risk dependencies in the High-Risk Dependencies table with 'Low Risk' or 'Org Backed' status notes?
What was checked, without and with the skill
Checked
Without skill
With skill
Omits low-risk dependencies from the High-Risk Dependencies table entirely.
Passed
Passed
Treats the absence of a dependency from the high-risk report table as the indicator that it is low or no risk.
Missed
Passed
case-11 · gemini-3.6-flash · 8/19/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md56 linessingle file
Supply Chain Risk Auditor
Activates when the user says "audit this project's dependencies".
When to Use
Assessing dependency risk before a security audit
Evaluating supply chain attack surface of a project
Identifying unmaintained or risky dependencies
Pre-engagement scoping for supply chain concerns
When NOT to Use
Active vulnerability scanning (use dedicated tools like npm audit, pip-audit)
Runtime dependency analysis
License compliance auditing
Purpose
Systematically evaluate all dependencies of a project to identify red flags that indicate a high risk of exploitation or takeover, and generate a summary report noting these issues.
Risk Criteria
A dependency is considered high-risk if it features any of the following risk factors:
Single maintainer or team of individuals - The project is primarily or solely maintained by a single individual, or a small number of individuals. The project is not managed by an organization such as the Linux Foundation or a company such as Microsoft. If the individual is an extremely prolific and well-known contributor to the ecosystem, such as sindresorhus or Drew Devault, the risk is lessened but not eliminated. Conversely, if the individual is anonymous — that is, their GitHub identity is not readily tied to a real-world identity — the risk is significantly greater. Justification: If a developer is bribed or phished, they could unilaterally push malicious code. Consider the left-pad incident.
Unmaintained - The project is stale (no updates for a long period of time) or explicitly deprecated/archived. The maintainer may have put a note in the README.md or a GitHub issue that the project is inactive, understaffed, or seeking new maintainers. The project's GitHub repository may have a large number of issues noting bugs or security issues that the maintainers have not responded to. Feature request issues do NOT count. Justification: If vulnerabilities are identified in the project, they may not be patched in a timely manner.
Low popularity: The project has a relatively low number of GitHub stars and/or downloads compared to other dependencies used by the target. Justification: Fewer users means fewer eyes on the project. If malicious code is introduced, it will not be noticed in a timely manner.
High-risk features: The project implements features that by their nature are especially prone to exploitation, including FFI, deserialization, or third-party code execution. Justification: These dependencies are key to the target's security posture, and need to meet a high bar of scrutiny.
Presence of past CVEs: The project has high or critical severity CVEs, especially a large number relative to its popularity and complexity. Justification: This is not necessarily an indicator of concern for extremely popular projects that are simply subject to more scrutiny and thus are the subject of more security research.
Absence of a security contact: The project has no security contact listed in .github/SECURITY.md, CONTRIBUTING.md, README.md, etc., or separately on the project's website (if one exists). Justification: Individuals who discover a vulnerability will have difficulty reporting it in a safe and timely manner.
Prerequisites
Ensure that the gh tool is available before continuing. Ask the user to install it if not found.
Workflow (Initial Setup)
Create a .supply-chain-risk-auditor directory for your workspace.
Start a results.md report file based on resources/results-template.md in this skill directory.