Trail of Bits Supply Chain Risk Auditor
plugintrailofbits · Security · claude-code, codex
Inspect dependency manifests and lockfiles for advisories, abandoned upstreams, publisher concentration and install-time scripts.
Setup, requirements & verification
Add trailofbits/skills as a plugin marketplace in Claude Code or Codex, then install supply-chain-risk-auditor@trailofbits using that client’s plugin installer. Keep the complete plugin and supporting scripts; review them before execution.
- Local source repository and Git history or dependency manifests/lockfiles.
- Some checks run scripts and query external package/advisory services; review required dependencies in the plugin.
License: CC-BY-SA-4.0
Open-source instructions; your assistant subscription and any external services are separate.
Source reviewed 2026-10-08. Installation not tested; task execution not tested.
Reviewed revision: 82fe8226252622fa807643bdca1710901198553a