/supply-chain-audit

Audit a project for software supply chain risk, including dependency vulnerabilities, lockfile issues, malicious package indicators, SBOM coverage, and license concerns.

Purpose

Use this command to perform a focused supply chain security review of a codebase. It helps identify dependency-related risk across JavaScript, Python, Go, Rust, Java, Ruby, and container-based projects.

The command reviews both direct and transitive dependencies, highlights the most important findings first, and recommends exact remediation steps where possible.

Usage

/supply-chain-audit /supply-chain-audit npm /supply-chain-audit python /supply-chain-audit docker /supply-chain-audit ./services/api /supply-chain-audit --report /supply-chain-audit --sbom /supply-chain-audit --licenses

Implementation

When this command runs, Claude should:

1. Detect the ecosystem by checking for package.json, requirements.txt, go.mod, Cargo.toml, pom.xml, Gemfile, or Dockerfile.

2. Inventory all dependencies: direct, transitive, dev, build-time, and base images.

3. Evaluate supply chain risk across:

• Known CVEs and advisories
• Unpinned or floating versions
• Missing or stale lockfiles
• Install scripts that execute code
• Typosquatting and suspicious naming
• Dependency confusion vectors
• Missing SBOM workflow
• License incompatibilities
• Weak CI/CD provenance

4. Present findings using severity tiers:

• CRITICAL
• HIGH
• MEDIUM
• LOW

5. For every finding include: what was detected, why it matters, how to verify it, and the exact remediation command.

6. Tailor remediation to the ecosystem:

• npm: npm audit, lockfile checks, .npmrc scoping, --save-exact
• Python: pip-audit, cyclonedx-py, lockfile verification
• Go: govulncheck, go mod verify
• Rust: cargo audit, cargo deny
• Java: dependency-check, Snyk, OWASP plugin
• Ruby: bundler-audit
• Docker: Syft, Grype, Trivy, digest pinning

7. End with an action plan: Fix now / Fix this sprint / Monitor / Nice to have

Examples

User: /supply-chain-audit Claude detects the package manager, checks lockfiles, flags floating versions, scans install hooks, and produces a ranked report with remediation commands.

User: /supply-chain-audit --sbom Claude checks whether an SBOM exists and recommends syft or cdxgen to generate one in CycloneDX or SPDX format, then explains how to attach it to CI artifacts.

User: /supply-chain-audit ./services/api Claude scopes the analysis to that directory, detects the local package manager, and produces findings only for that service.