Systematically audit project dependencies and CI/CD pipelines for supply chain vulnerabilities to mitigate A03:2025 Software Supply Chain Failures.
This skill guides the AI in identifying and remediating vulnerabilities introduced through third-party dependencies, libraries, and build tools. This directly addresses A03:2025 – Software Supply Chain Failures.
Use this skill when you need to evaluate the security posture of your project's dependencies or CI/CD pipelines.
Example Triggers:
package.json and help me fix the vulnerable dependencies?"npm audit or yarn auditpip-audit or safetytrivy or OWASP Dependency-Checknpm update <package>, modifying requirements.txt)..github/workflows) for risks like:
@v2) instead of specific commit SHAs.package-lock.json, poetry.lock).