supply-chain-risk-auditor

Enumerate all direct dependencies, locate their git repositories, then evaluate each against risk criteria like single maintainers, staleness, low popularity, and past CVEs. Use the gh CLI to gather accurate GitHub metrics and record flagged packages in a structured report.

Key risk factors include a single or anonymous maintainer, an unmaintained or archived repository, low popularity, dangerous features like FFI or deserialization, a history of high-severity CVEs, and the absence of a security contact for vulnerability reporting.

No. It explicitly does not perform active vulnerability scanning, runtime analysis, or license compliance checks. Tools like npm audit and pip-audit handle known-vulnerability detection, while this audit evaluates maintainer and project-health risk factors.

The GitHub CLI (gh) must be installed and available, since the audit relies on it to query exact repository data such as star counts, open issues, and maintainer activity. Cited numbers must come from real queries rather than estimates.

Avoid it for active CVE scanning, runtime dependency analysis, or license compliance auditing, which need dedicated tools. It is designed for pre-engagement scoping and dependency health assessment, not continuous vulnerability monitoring.