Dependency supply chain review
Skill jukrap/ai-agent-playbook/skills/security/dependency-supply-chain-review
Reusable AI agent skills, project templates, and guardrails for safer software maintenance and delivery.
npx -y skills add jukrap/ai-agent-playbook --skill dependency-supply-chain-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Use when changing dependencies, lockfiles, SBOMs, licenses, containers, package scripts, provenance, or vulnerability remediation.
SKILL.md
1.1 KB, as published. Nobody here has run it
Dependency Supply Chain Review
Use this as the primary security skill for dependency, SBOM, license, and provenance changes.
Workflow
- Identify package manager, lockfile, runtime artifact, container image, generated code, and release gate.
- Compare direct vs transitive dependency impact, license obligations, vulnerability exploitability, and runtime exposure.
- Prefer SBOM/provenance evidence and repository-defined audit commands over generic package advice.
- Verify lockfile consistency, tests/build, license policy, vulnerability scan output, and rollback/update notes.
Reference
Read references/dependency-supply-chain-checklist.md before adding/updating packages, changing lockfiles, reviewing CVEs, or preparing release compliance evidence.
Read references/sbom-attestation-release-gate.md when a release needs SBOM generation, license election, VEX/exception handling, image/source attestation, or artifact provenance verification.