supply-chain-risk-auditor
Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.
Profile →npx skills add waybarrios/opencode-power-pack --skill supply-chain-risk-auditor --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Supply Chain Risk Auditor Activates when the user says "audit this project's dependencies". ## When to Use - Assessing dependency risk before a security audit - Evaluating supply chain attack surface of a project - Identifying unmaintained or risky dependencies - Pre-engagement scoping for supply chain concerns ## When NOT to Use - Active vulnerability scanning (use dedicated tools like npm audit, pip-audit) - Runtime dependency analysis - License compliance auditing ## Purpose Systematically evaluate all dependencies of a project to identify red flags that indicate a high risk of exploitation or takeover, and generate a summary report noting these issues. ### Risk Criteria A dependency is considered high-risk if it features any of the following risk factors: * **Single maintainer or team of individuals** - The project is primarily or solely maintained by a single individual, or a small number of individuals. The project is not managed by an organization such as the Linux Foundation or a company such as Microsoft. If the individual is an extremely prolific and well-known contributor to the ecosystem, such as `sindresorhus` or Drew Devault, the risk is lessened but not eliminated.
- When to Use
- When NOT to Use
- Purpose
- Risk Criteria
- Prerequisites
- Workflow (Initial Setup)
- Workflow (Dependency Audit)
- Workflow (Post-Audit)
What does the supply-chain-risk-auditor skill do?
Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.
How do I install it?
Run `npx skills add waybarrios/opencode-power-pack --skill supply-chain-risk-auditor --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From waybarrios/opencode-power-pack, a repository with 443 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.