Audit Software Supply Chain Security & Verify CVE Reachability

Supply Chain Security assesses software supply-chain risk across a six-layer governance framework - source-code trust, build-pipeline integration, artifact-distribution integrity, runtime protection, continuous monitoring, and incident response - covering SBOM generation, software composition analysis (SCA), CI/CD pipeline security, container image audit, and vulnerability-reachability verification. SBOM generation covers CycloneDX (via cdxgen), SPDX (via sbom-tool), and Syft, with an audit checklist for unknown/unauthorized dependencies, deprecated packages, license conflicts, and direct-vs-transitive dependency inventory. SCA scanning runs OSV-Scanner (free, Google-maintained):

osv-scanner scan -r . --format json

alongside OWASP Dependency-Track for enterprise continuous monitoring, Snyk for commercial reachability-aware scanning, and Trivy for combined filesystem/container/IaC scanning. Its most load-bearing finding is stated directly: "SCA alert != actual risk - most SCA tools only have ~15% of alerts that are actually reachable," so the workflow filters to CVSS >= 7.0, runs reachability analysis via code-property-graph slicing or the DEPTEX method (Execution Path Dominance plus LLM semantic verification), verifies any PoC in an isolated environment, and only then prioritizes fixes by actual impact - with named tools (CodeQL, Snyk Code, DEPTEX) and a documented priority matrix (CVSS >=9.0 with a public PoC and confirmed reachability is P0/fix immediately; CVSS >=7.0 with a PoC and reachability is P1/fix this week; unreachable or PoC-less CVSS >=7.0 findings drop to P2). CI/CD pipeline security defines checkpoints at every stage (pre-commit secret scanning with gitleaks, PR-stage SCA, build-stage artifact signing with cosign, push-stage SBOM attestation, deployment-stage admission control via OPA/Kyverno, and runtime continuous monitoring) plus pipeline self-security checks (auditing GitHub Actions/GitLab CI configs for injection risk, runner isolation, no hardcoded secrets, third-party Actions pinned to a commit SHA rather than a mutable tag) mapped to the STRIDE threat model. Container image security covers Dockerfile linting (hadolint), multi-layer image scanning (Trivy for OS plus application dependencies plus config), preferring minimal base images (distroless > alpine > slim, never latest), and image signing/verification with cosign. Third-party dependency review runs a maintenance/security-history/dependency-tree/license/alternatives checklist against a stated risk matrix (high maintenance, low transitive-dependency count, compatible license = low risk; the inverse = high risk). A complete .github/workflows/supply-chain.yml example chains SBOM generation, OSV scan, Trivy scan, gitleaks secret scan, and a Dependency-Track upload into one automated pipeline, and a manual three-step verification method (confirm the actual installed version rather than trusting the SBOM field, confirm the CVE against OSV.dev/NVD, verify exploitability against a public PoC in an isolated container) grounds any single finding before it's trusted.

Use it for auditing how software is built, packaged, and depended upon, or verifying whether a disclosed CVE is actually reachable in a specific project rather than just present in the dependency tree. Do NOT trust a raw SCA alert as an actual risk without reachability verification - the skill's own stated finding is that roughly 85% of SCA alerts aren't reachable, so skipping that step routinely overstates risk. Its own limitations note that SBOM completeness depends on the maturity of ecosystem tooling, and reachability analysis is heuristic, so manual confirmation is advised before treating a "not reachable" verdict as final.

Input is a source repository, container image, or build pipeline configuration. Output is a generated SBOM (CycloneDX/SPDX), an SCA scan report with CVEs prioritized by CVSS and confirmed reachability, a CI/CD pipeline security audit against the STRIDE threat model, a container image scan result, and a third-party dependency risk assessment against the stated risk matrix.

Coordinates a large named toolchain: OWASP Dependency-Track, OSV-Scanner, Trivy, Syft, cdxgen, Cosign, Gitleaks, Snyk, and CodeQL, plus SLSA provenance generation and OPA/Kyverno for deployment admission control.

Security engineers and DevSecOps teams auditing a software supply chain - dependencies, build pipeline, container images, or a specific CVE's real reachability - who want a structured, evidence-based assessment rather than trusting a raw vulnerability-scanner alert count.