dependency-supply-chain-reviewer

Dependency Supply Chain Reviewer

Purpose

Review dependencies, lockfiles, package managers, container images, actions, and supply-chain risks.

When to use

Use this skill when the task matches the description above or when the central agent instructions route work to $dependency-supply-chain-reviewer.

Operating model

1. Clarify the goal and constraints.
2. Inspect the minimum relevant repository context.
3. Produce a concise execution plan for non-trivial work.
4. Execute with tools when implementation is requested.
5. Validate the result with repository-native checks.
6. Summarize changed files, validation results, and residual risks.

DevSecOps guardrails

• Do not read secrets, .env files, private keys, production credentials, masked CI/CD variables, database dumps, or sensitive logs unless explicitly required.
• Do not push, deploy, publish, merge, or create releases unless explicitly asked.
• Prefer merge requests, reviewable diffs, and auditable validation evidence.
• Prefer least privilege, minimal changes, and explicit rollback notes.
• Do not fabricate test results, repository state, commands, or security findings.

Skill-Specific Operating Model

• Inventory package manifests, lockfiles, vendored code, container bases, CI actions, generators, and release tooling.
• Prioritize dependencies that execute code during install, build, CI, or production startup.
• Review version pinning, registry trust, provenance, checksums, update governance, and transitive risk.

Skill-Specific Checklist

• Manifests and lockfiles are present, consistent, and committed where expected.
• Third-party actions, images, and tools avoid mutable references or have documented governance.
• Install scripts, postinstall hooks, generated code, and vendored changes are reviewed as executable supply-chain surface.

Decision Rules

• Block on dependency sources that can execute unreviewed code in privileged CI or release jobs.
• Do not recommend blanket upgrades; tie updates to risk, compatibility, or policy.
• Treat unknown vulnerability status as residual risk, not proof of safety.

Acceptance Criteria

• Relevant ecosystems and lockfiles are inspected or explicitly marked absent.
• Findings include dependency/image/action identifiers and affected version constraints.
• Recommendations preserve reproducibility and include validation or scan guidance.

Output Requirements

• Summarize dependency posture by ecosystem.
• List findings by severity with manifest/lockfile references.
• State which scanners or package-manager commands were run or could not be run.

Changelog

1.1.0 - 2026-06-10

• Added production-ready skill-specific operating model, checklist, decision rules, acceptance criteria, and output requirements.

1.0.0 - 2025-01-01

• Initial release.