Supply Chain Audit

# /supply-chain-audit

Audit a project for software supply chain risk, including dependency vulnerabilities, lockfile issues, malicious package indicators, SBOM coverage, and license concerns.

## Purpose

Use this command to perform a focused supply chain security review of a codebase. It helps identify dependency-related risk across JavaScript, Python, Go, Rust, Java, Ruby, and container-based projects.

The command reviews both direct and transitive dependencies, highlights the most important findings first, and recommends exact remediation steps where possible.

## Usage

/supply-chain-audit
/supply-chain-audit npm
/supply-chain-audit python
/supply-chain-audit docker
/supply-chain-audit ./services/api
/supply-chain-audit --report
/supply-chain-audit --sbom
/supply-chain-audit --licenses

## Implementation

When this command runs, Claude should:

1. Detect the ecosystem by checking for package.json, requirements.txt, go.mod, Cargo.toml, pom.xml, Gemfile, or Dockerfile.

2. Inventory all dependencies: direct, transitive, dev, build-time, and base images.

3. Evaluate supply chain risk across:
- Known CVEs and advisories
- Unpinned or floating versions
- Missing or stale lockfiles
- Install scripts that execute code
- Typosquatting and suspicious naming
- Dependency confusion vectors
- Missing SBOM workflow
- License incompatibilities
- Weak CI/CD provenance

4. Present findings using severity tiers:
- CRITICAL
- HIGH
- MEDIUM
- LOW

5. For every finding include: what was detected, why it matters, how to verify it, and the exact remediation command.

6. Tailor remediation to the ecosystem:
- npm: npm audit, lockfile checks, .npmrc scoping, --save-exact
- Python: pip-audit, cyclonedx-py, lockfile verification
- Go: govulncheck, go mod verify
- Rust: cargo audit, cargo deny
- Java: dependency-check, Snyk, OWASP plugin
- Ruby: bundler-audit
- Docker: Syft, Grype, Trivy, digest pinning

7. End with an action plan: Fix now / Fix this sprint / Monitor / Nice to have

## Examples

User: /supply-chain-audit
Claude detects the package manager, checks lockfiles, flags floating versions, scans install hooks, and produces a ranked report with remediation commands.

User: /supply-chain-audit --sbom
Claude checks whether an SBOM exists and recommends syft or cdxgen to generate one in CycloneDX or SPDX format, then explains how to attach it to CI artifacts.

User: /supply-chain-audit ./services/api
Claude scopes the analysis to that directory, detects the local package manager, and produces findings only for that service.

Preview capped at 60,000 characters. Download the bundle for every original file and notice.