Guide · Agent skill
How to use the Software Supply Chain Security agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The supply-chain-security skill is a set of written instructions that teaches an AI agent a structured workflow for software supply-chain security reviews. It covers software bill of materials (SBOM) generation, dependency vulnerability scanning, judging whether flagged vulnerabilities are reachable, and reviewing CI/CD pipeline and Dockerfile settings. This guide explains what the skill does, how to install it, how to trigger it, and what to check before relying on its output.
Software Supply Chain Securityzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it into ~/.claude/skills/ or the project's .claude/skills/ folder.
- 2Or upload in the apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 3Install the command-line tools. Install the tools you need, such as osv-scanner, trivy, syft, cdxgen and hadolint, using each tool's own install method.
- 4Confirm you are authorised. Make sure you own the target or have written permission to assess it, because the skill does not check this for you.
- 5Make a natural request. Ask for a specific task, such as an SBOM for a project or a scan of a container image.
- 6Review the output. Check which findings are reachable and verify the installed versions yourself before acting on them.
What the skill makes the agent do
Once installed, the agent follows a structured workflow for supply-chain security reviews. The skill's SKILL.md lists the work areas: SBOM generation and audit, software composition analysis (SCA), vulnerability reachability checks, CI/CD pipeline security, container image security, and review of third-party dependencies.
The skill is written as a guide to running commands. It does not bundle any code of its own, and the skill's text is mostly in Chinese.
- Generate an SBOM listing the components in a project (examples given: cdxgen for CycloneDX, Syft for SPDX-style output)
- Scan dependencies and container images for known vulnerabilities using tools such as OSV-Scanner, Trivy and Snyk
- Judge whether flagged vulnerabilities are reachable from the code, with a prioritisation scheme based on CVSS score and proof-of-concept availability
- Review pipeline settings and Dockerfiles, for example with gitleaks for secrets and hadolint for Dockerfiles
Install the supply-chain-security skill
Download the skill ZIP from this page and unzip it. Then place the folder in one of these locations:
For a personal install across projects, unzip into ~/.claude/skills/. For a single project, unzip into that project's .claude/skills/ folder. You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.
~/.claude/skills/supply-chain-security/Install the tools the skill calls
The skill tells the agent to run external command-line tools. It does not install them for you, so check which ones you have. The source names osv-scanner, trivy, syft, cdxgen (installed through npm), cosign, gitleaks, hadolint, docker, and snyk (installed through npm). Dependency-Track is optional and runs as a Docker container.
The skill's install table gives these methods: go install for OSV-Scanner, Cosign and Gitleaks; apt install for Trivy; npm install -g for cdxgen and Snyk; and docker pull for Dependency-Track. Check each tool's own documentation before running any install command.
- Snyk commercial features need a Snyk account and API token
- The skill expects network access to vulnerability databases such as OSV.dev, NVD and GitHub Advisory
- CodeQL is optional and comes with GitHub Actions
npm install -g @cyclonedx/cdxgen
npm install -g snyk
go install github.com/google/osv-scannerTrigger the skill with natural requests
You do not need a special command. Describe the task in plain language and mention the kind of review you want. The skill's description covers SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance and vulnerability reachability, so requests using those terms are the most likely to match.
Use a request that names the target and the goal, for example the project folder, the container image, or the pipeline file.
- Make an SBOM for this project and list the direct and transitive dependencies
- Scan this repo's dependencies for known vulnerabilities and tell me which ones are reachable from our code
- Review the GitHub Actions workflows in .github/workflows for risky patterns
- Check this Dockerfile and the nginx:latest image for high and critical issues
Examples of what the output looks like
The source does not give sample output, so treat any report format as something the agent produces, not a fixed template. For SCA, the skill suggests a priority scheme: CVSS 9.0 or higher with a public proof-of-concept and reachability is P0; CVSS 7.0 or higher with a proof-of-concept and reachability is P1; other cases are lower priority.
The reachability method in the skill is complex and partly tool-specific. Expect the agent to explain its reasoning, and check the conclusions against the code yourself.
Safety notes: scripts, network and authorisation
The reviewed files list no bundled scripts, but the skill makes the agent run commands and access the network to reach vulnerability databases. Run it in a project you control, and review commands the agent proposes before approving them where your setup allows.
The SKILL.md tells the agent to treat its operations as already authorised and to continue without pausing for confirmation. Do not rely on that. Only assess systems you own or have written permission to test, and make that check yourself before starting.
The skill also refers to two files that are not included in the reviewed material: ../tool-index.md and ../field-journal/precedent-pentest.md, plus a 'bootstrap' step. Expect the agent to hit missing references. Do not treat its tool-path or authorisation conclusions as verified.
Tips for getting reliable results
Treat SCA alerts as leads, not confirmed risks. The skill itself says most SCA alerts are not reachable, and it gives a figure of about 15%. Check that figure against your own results rather than assuming it.
Verify installed versions yourself. The skill's manual method says not to trust the SBOM version fields blindly and suggests checking the package manager or the package.json file directly.
Pin third-party GitHub Actions to a commit SHA rather than a tag, as the pipeline reference recommends.
- Start with one target, such as a single repository or image, before running broad scans
- Keep the SBOM output so you can compare it across runs
- Ask the agent to list which tools were missing or failed, since the skill depends on external tools
What people use it for
- Generating an SBOM for a project to list direct and transitive dependencies
- Triaging a long list of SCA alerts to find which vulnerabilities are reachable from the code
- Reviewing GitHub Actions or GitLab CI configuration for risky patterns such as broad token permissions
- Checking a Dockerfile with hadolint and scanning a base image with Trivy
- Assessing a new third-party dependency against a maintenance and licence checklist
Frequently asked questions
Is the supply-chain-security skill free?
The reviewed files show the skill is licensed under MIT. The skill uses OSV-Scanner and Trivy, which the source describes as free, but Snyk is commercial and needs an account and API token for its commercial features.
What do I need to run the supply-chain-security skill?
You need the command-line tools the skill calls, such as osv-scanner, trivy, syft, cdxgen, cosign, gitleaks, hadolint and docker, plus network access to vulnerability databases. Dependency-Track and Snyk are optional.
Where do I install the skill?
Unzip the downloaded ZIP into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
Does the skill run code on my machine?
The reviewed files say the skill runs no scripts of its own. It does, however, tell the agent to run external tools and access the network, so review the commands before approving them.
Why does the skill mention files that are not included?
The SKILL.md refers to ../tool-index.md, ../field-journal/precedent-pentest.md and a bootstrap step. These are not in the reviewed files, so the agent may fail to find them and the skill may be incomplete without them.
How does this compare with other supply-chain tools?
The skill is a workflow guide for an agent that calls tools such as OSV-Scanner, Trivy and Snyk. It is not a product of its own, so results depend on those tools, and the reviewed text gives little detail on interpreting their output.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a developer or security engineer who wants a repeatable checklist for dependency and build-pipeline audits, or a reviewer triaging many SCA alerts, and you already have the underlying tools installed. Pick something else if you want a turnkey product, a fully specified process with clear result interpretation, or if you cannot confirm that you are authorised to assess the target.
Download the skill