supply-chain-forensics

What problem does it solve?

This Skill addresses the critical need to detect and prevent compromises within the software supply chain, ensuring the integrity of packages, build processes, and CI/CD pipelines.

Core Features & Use Cases

• SBOM Analysis: Generates and validates Software Bill of Materials (SBOM) to identify components, licenses, and vulnerabilities.
• Dependency Verification: Checks package integrity against registry hashes to detect tampering and typosquatting.
• Build Pipeline Forensics: Scans CI/CD scripts and workflows for malicious patterns, unpinned actions, and unauthorized changes.
• Reproducibility Checks: Assesses the reproducibility of build artifacts and maps findings to SLSA levels.
• Use Case: A security team can use this skill to perform a comprehensive audit of a critical open-source project's supply chain, identifying potential vulnerabilities or signs of compromise before integrating it into their own systems.

Quick Start

Run a full supply chain audit on the current project.