AGENT SKILLS ATLASSupply Chain Security Scanner
AI-powered software supply chain security auditing skill for agentic platforms. Performs comprehensive dependency vulnerability scanning across npm, PyPI, Maven, Go modules, Cargo, and container images. Generates SBOMs (Software Bill of Materials) in SPDX and CycloneDX formats using Syft and Grype. Validates license compliance against organizational policies and detects copyleft risks. Verifies cryptographic provenance and SLSA framework attestations using cosign and slsa-verifier. Executes a structured audit methodology—Scan → Analyze → Report → Remediate—producing machine-readable vulnerability reports with CVSS scores, exploitability assessments, and actionable fix recommendations aligned with OWASP Agentic Skills Top 10 guidance. Integrates with ecosystem vulnerability databases including NVD (National Vulnerability Database), GitHub Advisory Database (GHSA), and Open Source Vulnerabilities (OSV). Covers software composition analysis (SCA) workflows, dependency confusion detection, typosquatting checks, and end-to-end software supply chain integrity verification. Designed for CI/CD pipeline integration, pre-commit hooks, and ad-hoc security audits. Suitable for DevSecOps teams, open-source maintainers, and enterprise compliance programs adopting SLSA Level 1–3 supply chain security requirements. Works with existing toolchains: npm audit, pip-audit, OWASP Dependency-Check, Syft, Grype, cosign, slsa-verifier, and trivy. All findings include remediation paths and SBOM lifecycle management guidance.
Skill stats
Skills1CategorySecurityStars0
About this skill
AI-powered software supply chain security auditing skill for agentic platforms. Performs comprehensive dependency vulnerability scanning across npm, PyPI, Maven, Go modules, Cargo, and container images. Generates SBOMs (Software Bill of Materials) in SPDX and CycloneDX formats using Syft and Grype. Validates license compliance against organizational policies and detects copyleft risks. Verifies cryptographic provenance and SLSA framework attestations using cosign and slsa-verifier. Executes a structured audit methodology—Scan → Analyze → Report → Remediate—producing machine-readable vulnerability reports with CVSS scores, exploitability assessments, and actionable fix recommendations aligned with OWASP Agentic Skills Top 10 guidance. Integrates with ecosystem vulnerability databases including NVD (National Vulnerability Database), GitHub Advisory Database (GHSA), and Open Source Vulnerabilities (OSV). Covers software composition analysis (SCA) workflows, dependency confusion detection, typosquatting checks, and end-to-end software supply chain integrity verification. Designed for CI/CD pipeline integration, pre-commit hooks, and ad-hoc security audits. Suitable for DevSecOps teams, open-source maintainers, and enterprise compliance programs adopting SLSA Level 1–3 supply chain security requirements. Works with existing toolchains: npm audit, pip-audit, OWASP Dependency-Check, Syft, Grype, cosign, slsa-verifier, and trivy. All findings include remediation paths and SBOM lifecycle management guidance.
Quick start
- Copy the install prompt. Use the green button above this README.
- Send it to your agent. Paste it into your coding agent’s chat and send.
- Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.
Installation guide →
Review, license & listing details
Review the source before using this skillThis is an imported listing. We haven’t certified its safety, license, or compatibility. Skills may include executable scripts.
Original listing metadata
Original name
supply-chain-security-scannerOriginal description
AI-powered software supply chain security auditing skill for agentic platforms. Performs comprehensive dependency vulnerability scanning across npm, PyPI, Maven, Go modules, Cargo, and container images. Generates SBOMs (Software Bill of Materials) in SPDX and CycloneDX formats using Syft and Grype. Validates license compliance against organizational policies and detects copyleft risks. Verifies cryptographic provenance and SLSA framework attestations using cosign and slsa-verifier. Executes a structured audit methodology—Scan → Analyze → Report → Remediate—producing machine-readable vulnerability reports with CVSS scores, exploitability assessments, and actionable fix recommendations aligned with OWASP Agentic Skills Top 10 guidance. Integrates with ecosystem vulnerability databases including NVD (National Vulnerability Database), GitHub Advisory Database (GHSA), and Open Source Vulnerabilities (OSV). Covers software composition analysis (SCA) workflows, dependency confusion detection, typosquatting checks, and end-to-end software supply chain integrity verification. Designed for CI/CD pipeline integration, pre-commit hooks, and ad-hoc security audits. Suitable for DevSecOps teams, open-source maintainers, and enterprise compliance programs adopting SLSA Level 1–3 supply chain security requirements. Works with existing toolchains: npm audit, pip-audit, OWASP Dependency-Check, Syft, Grype, cosign, slsa-verifier, and trivy. All findings include remediation paths and SBOM lifecycle management guidance.
About this listing
- Category
- Security
- Reported license
- Not specified
- Listing language (estimated)
- English
- Review status
- Not individually reviewed
- Agent compatibility
- Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.
Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLI