Skip to content
Get packs

Software Supply Chain Security

Lets an agent audit a project's dependencies, SBOMs, CI/CD pipelines and container images for supply-chain risk

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

Once installed, the agent follows a structured workflow for supply-chain security reviews. It can generate a software bill of materials (SBOM) listing every component in a project, scan dependencies and container images for known vulnerabilities using tools such as OSV-Scanner, Trivy and Snyk, judge whether flagged vulnerabilities are actually reachable from the code, and review CI/CD pipeline and Dockerfile settings. The skill's text is mostly in Chinese, and it is written as a guide to running commands rather than bundling any code of its own.

Great for

  • Developers or security engineers who want a repeatable checklist for auditing dependencies and build pipelines
  • Teams preparing SBOMs or compliance evidence under regulations such as US SBOM mandates, China's national standards or the EU CRA
  • Reviewers triaging a long list of SCA alerts to find which ones matter

Skip it if

  • Testing systems you do not own or have written permission to assess: the SKILL.md tells the agent to treat its operations as already authorised and to keep going without pausing for confirmation, so the user must supply that check
  • Anyone expecting a turnkey product: the skill depends on external tools and on two referenced files (tool-index and a field journal) that are not included in the reviewed files
  • Teams that need a vetted, fully specified process: much of the text is a list of tool names and commands with little detail on interpreting results

Try asking

  • “Generate a CycloneDX or SPDX SBOM for this repository and list the direct and transitive dependencies that are unmaintained or have licence conflicts”
  • “Run OSV-Scanner and Trivy on this project and rank the high and critical CVEs by whether the vulnerable code path is reachable”
  • “Review our GitHub Actions workflows for unpinned third-party actions and hard-coded secrets”
  • “Audit this Dockerfile and container image with hadolint and Trivy and suggest a smaller base image”
Step-by-step guide: how to use Software Supply Chain SecurityInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    supply-chain-security.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip supply-chain-security.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip supply-chain-security.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Before running anything, confirm you own the target or have written authorisation. The skill tells the agent to skip that confirmation step.
  • Check every install command before the agent runs it. The skill suggests curl-piped install scripts and 'docker pull' of third-party images.
  • Treat tool output as a starting point: the skill says only about 15% of SCA alerts are reachable, but gives no source for that figure, so verify findings before acting on them

What's inside

  • references/cicd-pipeline-security.md
  • references/sbom-sca-methodology.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.