Audit Software Supply Chain Security & Verify CVE Reachability

This skill audits software supply-chain security across a six-layer model: source-trust review of upstream repos and maintainers, CI/CD pipeline security gates, artifact distribution integrity (signatures, checksums, SBOM attachment), runtime protection (container scanning, admission control), continuous CVE monitoring and reachability analysis, and incident response for supply-chain attacks.

Use it to audit how software is built, packaged, and depended upon, or to verify whether a disclosed CVE is actually reachable in a project rather than just present somewhere in a dependency tree. The skill explicitly treats a raw scanner alert count as a starting point rather than a conclusion - most SCA alerts, roughly 15% by its own estimate, turn out to be actually reachable risk - so it pushes toward reachability analysis before prioritizing fixes.

Input is a codebase, container image, or CI/CD pipeline configuration. Output includes an SBOM (CycloneDX via cdxgen, or SPDX) with a dependency and licensing audit; SCA findings from OSV-Scanner, Dependency-Track, Snyk, or Trivy; a reachability-filtered subset of high-CVSS (7.0 or above) vulnerabilities using code-property-graph slicing or LLM-assisted methods such as DEPTEX; hardened CI/CD checkpoints spanning pre-commit secret scanning, PR-stage SCA, build-stage artifact signing, SBOM attachment, and deployment admission control; and a new-dependency risk checklist scoring maintenance activity, security history, transitive dependency growth, and license compatibility - a package with high maintenance, few new transitive dependencies, and a compatible license scores low risk, while one with low maintenance, many new dependencies, and a license conflict scores high risk. The pipeline itself is treated as an asset to audit too: pipeline-as-code configuration for injection risk, build-runner isolation so a malicious build can't escape its container, secrets kept in a manager rather than hardcoded, and third-party actions pinned to a commit SHA rather than a mutable tag.

Dependency-Track, OSV-Scanner, Snyk, and Trivy perform software composition analysis; Syft and cdxgen generate SBOMs; cosign signs and verifies container images. A typical scan looks like:

trivy image --severity HIGH,CRITICAL nginx:latest

CodeQL supports data-flow-based reachability analysis; gitleaks scans for committed secrets; hadolint audits Dockerfiles; OPA or Kyverno enforce admission control at deploy time.

Application security and platform engineers auditing a project's build, dependency, and container supply chain, who need to separate the small share of genuinely reachable, exploitable vulnerabilities from the much larger volume of raw SCA alerts.