Supply Chain Audit

Supply Chain Audit Skill

Auditing software supply chain security across CI/CD pipelines, container images, and language package ecosystems. Produces structured findings with severity ratings, file:line references, and actionable fix templates.

When to Use This Skill

• CI/CD security review: Unpin action refs, excessive permissions, secret leakage
• Dependency pinning: Lock files missing, hash verification absent, mutable semver refs
• Container supply chain: Mutable base image tags, non-root execution, SBOM generation
• Credential hygiene: OIDC migration from long-lived secrets, subject constraint gaps
• Compliance mapping: SLSA L1-L4 readiness assessment, SBOM generation guidance
• Pre-merge gate: Block PRs that introduce High/Critical supply chain regressions

Prerequisites — External Tool Check

Before running the audit, check for missing external tools and offer to install them:

from supply_chain_audit.external_tools import check_missing_tools, install_tool

missing = check_missing_tools()
if missing:
    # Show the user what's missing and what each tool does
    for tool in missing:
        print(f"Missing: {tool['name']} — {tool['description']}")
        for opt in tool['install_options']:
            print(f"  Install: {opt}")

    # Ask the user if they want to install
    # If yes, install each one:
    for tool in missing:
        success, msg = install_tool(tool['name'])
        print(f"  {tool['name']}: {msg}")

The audit runs without these tools (offline/degraded mode) but produces fewer findings:

Ecosystem Detection

Detect which dimensions apply before running checks:

Run all triggered dimensions. Report skipped dimensions explicitly.

12 Audit Dimensions

Dimensions 1-4: GitHub Actions

See reference/actions.md

Dimensions 5 & 12: Containers

See reference/containers.md

Dimension 6: Credentials

See reference/credentials.md

Dimension 7: .NET / NuGet

See reference/dotnet.md

Dimension 8: Python

See reference/python.md

Dimension 9: Rust

See reference/rust.md

Dimension 10: Node.js

See reference/node.md

Dimension 11: Go

See reference/go.md

5-Step Audit Workflow

Step 1: Scope Detection

# Detect active ecosystems
ls .github/workflows/*.yml 2>/dev/null && echo "GHA detected"
ls Dockerfile docker-compose.yml 2>/dev/null && echo "Containers detected"
ls requirements*.txt pyproject.toml 2>/dev/null && echo "Python detected"
ls package.json 2>/dev/null && echo "Node detected"
ls go.mod 2>/dev/null && echo "Go detected"
ls Cargo.toml 2>/dev/null && echo "Rust detected"
ls *.csproj 2>/dev/null && echo ".NET detected"

Record active dimensions. Skip and annotate inactive ones in the report.

Step 2: Static Analysis (per ecosystem)

Run dimension-specific checks from each reference file. Collect raw findings with:

• Dimension number
• File path and line number (file:line)
• Current value (the offending pattern)
• Expected value (the fix)
• Severity: Critical / High / Medium / Info

Step 3: Severity Scoring

Map findings to CVSS-aligned severity bands:

Step 4: Report Generation

Produce a structured markdown report:

## Supply Chain Audit Report

**Date**: YYYY-MM-DD
**Scope**: [list active ecosystems]
**Skipped**: [list inactive ecosystems with reason]

### Summary

| Severity | Count |
| -------- | ----- |
| Critical | N     |
| High     | N     |
| Medium   | N     |
| Info     | N     |

### Findings

#### CRITICAL-001 · Dim 1 · Unpin third-party action

- **File**: `.github/workflows/release.yml:14`
- **Current**: `uses: actions/checkout@v4`
- **Expected**: `uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2`
- **Fix**: Look up SHA at https://github.com/actions/checkout/releases

### SLSA Readiness

[See reference/sbom-slsa.md for compliance table]

### Recommended Next Steps

1. Fix all Critical findings before next deployment
2. Delegate lock-file issues to `dependency-resolver` skill
3. Install SHA-pinning pre-commit hooks via `pre-commit-manager` skill

Step 5: Remediation Prioritization

Order fixes:

1. Critical first: Unpin + write-permissions + secret-access combinations
2. High: Any mutable reference in production workflows
3. Delegate: Lock file generation to dependency-resolver
4. Automate: Pre-commit enforcement via pre-commit-manager
5. Compliance: SBOM generation, SLSA provenance — see reference/sbom-slsa.md

Output Format Conventions

• Every finding includes file:line (e.g., .github/workflows/ci.yml:23)
• Fix templates are copy-pasteable with no placeholders requiring guessing
• SHA lookups always reference the official release page URL
• Severity is explicit per finding; never implicit
• Report ends with a "next steps" section distinguishing manual vs. automatable fixes

Integration Points

Evaluation Scenarios

See reference/eval-scenarios.md for three graded scenarios:

• Scenario A: GitHub Actions monorepo — GHA + Python + Node (7 planted findings)
• Scenario B: Containerized Go service — Containers + Go + Credentials (5 findings)
• Scenario C: .NET + Rust mixed repo — .NET + Rust + SLSA readiness (6 findings)

Additional Reference

• SBOM generation, CVSS scoring, SLSA L1-L4 mapping, fix-PR workflow
• Invocation interface, finding schema, inter-skill contracts, error handling
• GitHub Actions SHA lookup: gh api repos/{owner}/{repo}/git/ref/tags/{tag}
• SLSA framework: https://slsa.dev
• OpenSSF Scorecard: https://securityscorecards.dev

Related Skills

• dependency-resolver — lock file conflict resolution
• pre-commit-manager — automated quality enforcement hooks
• cybersecurity-analyst — runtime security and threat modeling
• silent-degradation-audit — CI reliability and regression detection
• pr-review-assistant — philosophy-aware PR review including supply chain checks