Audit Project Dependencies for Supply Chain Risks

Supply Chain Risk Auditor systematically evaluates every dependency of a project to identify red flags indicating a high risk of exploitation or takeover, then generates a summary report of only the flagged dependencies. It activates when the user says "audit this project's dependencies."

Use this when assessing dependency risk before a security audit, evaluating a project's supply chain attack surface, identifying unmaintained or risky dependencies, or scoping supply chain concerns before an engagement. It is explicitly not for active vulnerability scanning, where dedicated tools like npm audit or pip-audit fit better, runtime dependency analysis, or license compliance auditing.

Requires the gh CLI tool. Six risk criteria flag a dependency as high-risk: a single maintainer or small team not backed by an organization, with risk lessened but not eliminated for extremely prolific, identifiable contributors and significantly greater for anonymous maintainers, referencing the left-pad incident as the underlying justification; being unmaintained, meaning stale, explicitly deprecated or archived, or carrying unanswered bug and security issues, where feature requests don't count; low popularity relative to comparable dependencies, meaning fewer eyes to catch malicious code; high-risk features like FFI, deserialization, or third-party code execution that demand extra scrutiny; a history of high or critical CVEs, weighted against the project's popularity and complexity since heavily-scrutinized popular projects naturally accumulate more findings; and no listed security contact in SECURITY.md, CONTRIBUTING.md, README.md, or the project website, making safe vulnerability reporting difficult. The three-phase workflow: initial setup creates a .supply-chain-risk-auditor workspace with a results.md report seeded from results-template.md, finds the git repository for every direct dependency, and normalizes name/project-format entries into full GitHub URLs; the dependency audit evaluates each repository against the six risk criteria using gh to pull accurate, citable numbers such as stars and open issues, rounded with ~ notation when appropriate, adding only dependencies that trip at least one criterion to the High-Risk Dependencies table with the specific reason and omitting low-risk dependencies entirely rather than listing them as "safe"; and the post-audit phase fills in a suggested alternative per flagged dependency, preferring direct successors or drop-in replacements with a short justification, tallies counts by risk-factor category, and writes an Executive Summary and Recommendations section.

Built around the GitHub CLI (gh) for pulling live repository metadata, such as stars, issue counts, and maintenance signals, rather than guessed figures, and constrained to exactly the sections defined in results-template.md - no additional sections, and no "opposite" columns noting why a dependency is low-risk.

Security engineers and auditors scoping a project's software supply chain risk before a deeper security engagement, who need a concise, evidence-backed list of specifically risky dependencies with suggested replacements rather than a full vulnerability scan.