[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M755K87FJ64FAQPXGYJ4EBJY":3,"skill-same:01M755K87FJ64FAQPXGYJ4EBJY":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":32,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":35,"ownerDescription":36,"updatedAt":37,"install":38,"resources":50},"01M755K87FJ64FAQPXGYJ4EBJY","x-audit-supply-chain",null,"Enhanced supply chain security audit beyond x-audit-dependencies. Analyzes maintainer risk, typosquatting detection, phantom dependencies, dependency age, EPSS scoring, and SLSA assessment. Produces SARIF 2.1.0 output with weighted risk scoring.","review-bench\u002Federcnj_ia-dev-environment","review-bench","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F286778065?v=4","01M7517F9NTEPDZDAXJBR30FWT","ReviewBench","01M7517FAC9F4P7TGWCNJ8VYVW",0,"MIT","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-neo4j\u002F.claude\u002Fskills\u002Fx-audit-supply-chain\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: x-audit-supply-chain\ndescription: \"Enhanced supply chain security audit beyond x-audit-dependencies. Analyzes maintainer risk, typosquatting detection, phantom dependencies, dependency age, EPSS scoring, and SLSA assessment. Produces SARIF 2.1.0 output with weighted risk scoring.\"\nuser-invocable: true\nallowed-tools: Read, Write, Bash, Grep, Glob\nargument-hint: \"[--depth shallow|deep] [--include-dev-deps] [--risk-threshold 0-100] [--focus all|maintainer|typosquatting|phantom|age|epss|slsa]\"\ncontext-budget: medium\nrequires-capabilities: []\n---\n\n## Global Output Policy\n\n- **Language**: English ONLY.\n- **Tone**: Technical, Direct, and Concise.\n- **Efficiency**: Remove all conversational fillers and greetings to save tokens.\n\n# Skill: Enhanced Supply Chain Audit\n\n## Purpose\n\nPerforms advanced supply chain security analysis for {{PROJECT_NAME}} that complements (does NOT replace) the existing `x-audit-dependencies` skill. While `x-audit-dependencies` focuses on known CVEs, outdated versions, and license compliance, this skill identifies deeper supply chain risks: single-maintainer dependencies, typosquatting suspects, phantom dependencies, stale packages, EPSS exploit prediction, and SLSA integrity assessment.\n\n## Relationship with x-audit-dependencies\n\n| Capability | x-audit-dependencies | x-audit-supply-chain |\n|------------|-------------------|----------------------|\n| Known CVEs | Yes | No (defers to x-audit-dependencies) |\n| Outdated versions | Yes | No (defers to x-audit-dependencies) |\n| License compliance | Yes | Extends with copyleft risk scoring |\n| SBOM generation | Yes (CycloneDX) | No (defers to x-audit-dependencies) |\n| Maintainer risk | No | Yes (bus factor analysis) |\n| Typosquatting | No | Yes (Levenshtein distance) |\n| Phantom dependencies | No | Yes (AST scan vs manifest diff) |\n| Dependency age | No | Yes (registry metadata) |\n| EPSS scoring | No | Yes (FIRST.org API) |\n| SLSA assessment | No | Yes (provenance verification) |\n| Risk scoring | Basic (severity only) | Multi-dimensional (5 weighted factors) |\n\nBoth skills can be executed independently. Results from both feed into the security dashboard.\n\n## Triggers\n\n- `\u002Fx-audit-supply-chain` — full supply chain audit (all 6 capabilities)\n- `\u002Fx-audit-supply-chain --depth deep` — deep analysis including transitive dependencies\n- `\u002Fx-audit-supply-chain --focus maintainer` — maintainer risk analysis only\n- `\u002Fx-audit-supply-chain --focus typosquatting` — typosquatting detection only\n- `\u002Fx-audit-supply-chain --focus phantom` — phantom dependency detection only\n- `\u002Fx-audit-supply-chain --focus age` — dependency age analysis only\n- `\u002Fx-audit-supply-chain --focus epss` — EPSS exploit prediction only\n- `\u002Fx-audit-supply-chain --focus slsa` — SLSA level assessment only\n- `\u002Fx-audit-supply-chain --risk-threshold 50` — filter findings below score 50\n- `\u002Fx-audit-supply-chain --include-dev-deps` — include dev dependencies\n\n## Parameters\n\n| Parameter | Type | Default | Validation | Description |\n|-----------|------|---------|------------|-------------|\n| `--depth` | String | shallow | enum: shallow, deep | shallow = direct deps only; deep = includes transitive |\n| `--include-dev-deps` | boolean | false | — | Include development dependencies in analysis |\n| `--risk-threshold` | int | 0 | 0-100 | Exclude findings with risk score below this value |\n| `--focus` | String | all | enum: all, maintainer, typosquatting, phantom, age, epss, slsa | Analyze specific risk category only |\n\n## Workflow\n\n```\n1. DETECT      -> Identify build tool and parse manifest\n2. RESOLVE     -> Build dependency graph (direct + transitive)\n3. ANALYZE     -> Run 6 parallel analysis capabilities\n4. SCORE       -> Calculate weighted risk score per dependency\n5. FILTER      -> Apply risk-threshold and focus filters\n6. REPORT      -> Generate SARIF 2.1.0 + Markdown report\n```\n\n### Step 1 — Detect Build Tool and Parse Manifest\n\nThe project uses **{{BUILD_TOOL}}** as its build tool. Parse the dependency manifest:\n\n| Build Tool | Manifest File | Lock File |\n|-----------|--------------|-----------|\n| npm | package.json | package-lock.json |\n| yarn | package.json | yarn.lock |\n| pnpm | package.json | pnpm-lock.yaml |\n| maven | pom.xml | — |\n| gradle | build.gradle \u002F build.gradle.kts | gradle.lockfile |\n| cargo | Cargo.toml | Cargo.lock |\n| pip | requirements.txt \u002F pyproject.toml | requirements.txt |\n| poetry | pyproject.toml | poetry.lock |\n| go mod | go.mod | go.sum |\n\n### Step 2 — Resolve Dependency Graph\n\nBuild the full dependency graph distinguishing direct vs transitive:\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npm ls --all --json` |\n| maven | `mvn dependency:tree -DoutputType=text` |\n| gradle | `gradle dependencies --configuration runtimeClasspath` |\n| cargo | `cargo tree --format {p}:{l}` |\n| pip | `pipdeptree --json` |\n| poetry | `poetry show --tree` |\n| go mod | `go mod graph` |\n\n### Step 3 — Analysis Capabilities\n\n#### 3.1 — Maintainer Risk Analysis\n\nIdentify dependencies with single-maintainer risk (bus factor = 1):\n\n| Registry | API Endpoint | Maintainer Field |\n|----------|-------------|-----------------|\n| npm | `https:\u002F\u002Fregistry.npmjs.org\u002F{pkg}` | `maintainers[]` |\n| Maven Central | `https:\u002F\u002Fsearch.maven.org\u002Fsolrsearch\u002Fselect?q=a:{artifact}` | POM developers section |\n| PyPI | `https:\u002F\u002Fpypi.org\u002Fpypi\u002F{pkg}\u002Fjson` | `info.maintainers[]` |\n| crates.io | `https:\u002F\u002Fcrates.io\u002Fapi\u002Fv1\u002Fcrates\u002F{pkg}` | `crate.owners[]` |\n| Go | Module repository metadata | — |\n\n**Scoring:**\n- 1 maintainer: risk = 100 (HIGH severity)\n- 2-3 maintainers: risk = 50 (MEDIUM severity)\n- 4+ maintainers: risk = 0 (no risk)\n\n#### 3.2 — Typosquatting Detection\n\nDetect dependency names suspiciously similar to popular packages using Levenshtein distance:\n\n1. For each dependency, compute Levenshtein distance against a known list of popular packages for the ecosystem\n2. Flag packages with distance \u003C 2 from a popular package\n3. Popular package lists per ecosystem:\n\n| Registry | Popular Packages Source |\n|----------|----------------------|\n| npm | Top 1000 by weekly downloads |\n| Maven Central | Top artifacts by usage |\n| PyPI | Top 1000 by monthly downloads |\n| crates.io | Top crates by downloads |\n\n**Scoring:**\n- Levenshtein distance = 1: risk = 100 (CRITICAL severity)\n- Same name different scope\u002Forg: risk = 75 (HIGH severity)\n\n#### 3.3 — Phantom Dependency Detection\n\nIdentify imports in source code that are not declared in the manifest:\n\n1. Scan source files for import statements:\n\n| Language | Import Pattern |\n|----------|---------------|\n| Java\u002FKotlin | `import {package}.{Class}` |\n| TypeScript\u002FJS | `import ... from '{module}'` \u002F `require('{module}')` |\n| Python | `import {module}` \u002F `from {module} import ...` |\n| Go | `import \"{module}\"` |\n| Rust | `use {crate}::...` \u002F `extern crate {name}` |\n\n2. Cross-reference detected imports against declared dependencies in manifest\n3. Flag imports that resolve to undeclared dependencies\n\n**Scoring:**\n- Phantom dependency found: risk = 75 (MEDIUM severity)\n\n#### 3.4 — Dependency Age Analysis\n\nCheck time since last release for each dependency:\n\n| Registry | Last Release API |\n|----------|-----------------|\n| npm | `https:\u002F\u002Fregistry.npmjs.org\u002F{pkg}` -> `time.modified` |\n| Maven Central | `https:\u002F\u002Fsearch.maven.org\u002Fsolrsearch\u002Fselect` -> `timestamp` |\n| PyPI | `https:\u002F\u002Fpypi.org\u002Fpypi\u002F{pkg}\u002Fjson` -> `urls[].upload_time` |\n| crates.io | `https:\u002F\u002Fcrates.io\u002Fapi\u002Fv1\u002Fcrates\u002F{pkg}` -> `crate.updated_at` |\n\n**Scoring:**\n- Last release > 2 years: risk = 100 (HIGH severity)\n- Last release 1-2 years: risk = 75 (MEDIUM severity)\n- Last release 6-12 months: risk = 25 (LOW severity)\n- Last release \u003C 6 months: risk = 0 (no risk)\n\n#### 3.5 — EPSS Scoring (Exploit Prediction)\n\nQuery FIRST.org EPSS API for exploit probability of known CVEs:\n\n- **API:** `https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve={CVE-ID}`\n- **Response field:** `epss` (probability 0.0-1.0 of exploit within 30 days)\n\n**Scoring:**\n- EPSS >= 0.5: risk = 100 (CRITICAL severity — high probability of exploit)\n- EPSS 0.1-0.49: risk = 75 (HIGH severity)\n- EPSS 0.01-0.09: risk = 50 (MEDIUM severity)\n- EPSS \u003C 0.01: risk = 25 (LOW severity)\n\n#### 3.6 — SLSA Assessment\n\nEvaluate Supply-chain Levels for Software Artifacts compliance:\n\n| SLSA Level | Requirements | Score |\n|-----------|-------------|-------|\n| SLSA 0 | No guarantees | risk = 100 |\n| SLSA 1 | Build process documented | risk = 75 |\n| SLSA 2 | Hosted build, signed provenance | risk = 50 |\n| SLSA 3 | Hardened builds, non-falsifiable provenance | risk = 25 |\n\nCheck for:\n- Signed releases \u002F provenance attestations\n- Reproducible builds\n- Build system documentation\n- Source-to-build mapping\n\n### Step 4 — Risk Scoring\n\nCalculate weighted risk score for each dependency:\n\n```\nrisk_score = (cve_severity * 0.40)\n           + (depth_score * 0.20)\n           + (maintainer_risk * 0.15)\n           + (license_risk * 0.15)\n           + (popularity_inverse * 0.10)\n```\n\n**Factor Ranges (all 0-100):**\n\n| Factor | Calculation |\n|--------|------------|\n| cve_severity | CVSS score normalized to 0-100 |\n| depth_score | direct = 100, depth 1 = 75, depth 2 = 50, depth 3+ = 25 |\n| maintainer_risk | single = 100, 2-3 = 50, 4+ = 0 |\n| license_risk | copyleft = 100, weak-copyleft = 50, permissive = 0, unknown = 75 |\n| popularity_inverse | downloads \u003C 1000\u002Fweek = 100, \u003C 10000 = 50, >= 10000 = 0 |\n\n**Severity Classification:**\n\n| Risk Score | Severity |\n|-----------|----------|\n| 80-100 | CRITICAL |\n| 60-79 | HIGH |\n| 40-59 | MEDIUM |\n| 20-39 | LOW |\n| 0-19 | INFO |\n\n### Step 5 — Apply Filters\n\n1. If `--focus` is not `all`, include only findings matching the specified `riskCategory`\n2. If `--risk-threshold` > 0, exclude findings with `riskScore` below the threshold\n3. If `--include-dev-deps` is false, exclude dev\u002Ftest-scoped dependencies\n4. If `--depth` is `shallow`, exclude transitive dependencies\n\n### Step 6 — Generate Reports\n\n#### 6.1 — SARIF 2.1.0 Output\n\nWrite SARIF to `results\u002Faudits\u002Fsupply-chain-audit-YYYY-MM-DD.sarif.json`:\n\nFollow the SARIF template from `knowledge\u002Fsecurity\u002Fsarif-template.md`. Use tool name `x-audit-supply-chain` and rule IDs:\n\n| Rule ID | Name | Category |\n|---------|------|----------|\n| SCA-MAINT-001 | SingleMaintainerDependency | maintainer |\n| SCA-TYPO-001 | TyposquattingSuspect | typosquatting |\n| SCA-PHANTOM-001 | PhantomDependency | phantom |\n| SCA-AGE-001 | StaleDependency | age |\n| SCA-EPSS-001 | HighExploitProbability | epss |\n| SCA-SLSA-001 | LowSlsaLevel | slsa |\n\n#### 6.2 — Markdown Report\n\nWrite report to `results\u002Faudits\u002Fsupply-chain-audit-YYYY-MM-DD.md`:\n\n```markdown\n# Supply Chain Audit Report — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Build Tool:** {{BUILD_TOOL}}\n**Depth:** {shallow|deep}\n**Focus:** {focus}\n\n## Summary\n\n| Metric | Value |\n|--------|-------|\n| Overall Score | {overallScore}\u002F100 |\n| Grade | {grade} |\n| Total Dependencies | {totalDependencies} |\n| Direct Dependencies | {directDependencies} |\n| Transitive Dependencies | {transitiveDependencies} |\n\n## Risk Distribution\n\n| Category | Count | Highest Severity |\n|----------|-------|-----------------|\n| Maintainer Risk | {singleMaintainerCount} | {severity} |\n| Typosquatting Suspects | {typosquattingSuspects} | {severity} |\n| Phantom Dependencies | {phantomDependencies} | {severity} |\n| Stale Dependencies | {staleDependencies} | {severity} |\n| EPSS High Risk | {epssHighRisk} | {severity} |\n| SLSA Level | {slsaLevel} | {severity} |\n\n## Findings\n\n### [SCA-MAINT-001] {packageName}@{version}\n- **Category:** Maintainer Risk\n- **Risk Score:** {riskScore}\u002F100\n- **Severity:** {severity}\n- **Detail:** {detail}\n- **Recommendation:** {fixRecommendation}\n\n### [SCA-TYPO-001] {packageName}@{version}\n- **Category:** Typosquatting\n- **Risk Score:** {riskScore}\u002F100\n- **Severity:** CRITICAL\n- **Detail:** Name similar to \"{popularPackage}\" (Levenshtein distance: {distance})\n- **Recommendation:** Verify the correct package is being used\n\n## Scoring Methodology\n\nRisk Score = (CVE Severity * 0.40) + (Depth * 0.20)\n           + (Maintainer * 0.15) + (License * 0.15)\n           + (Popularity * 0.10)\n\n## Grade Scale\n\n| Grade | Score Range | Description |\n|-------|------------|-------------|\n| A | 90-100 | Excellent supply chain posture |\n| B | 80-89 | Good posture with minor risks |\n| C | 70-79 | Acceptable but improvement needed |\n| D | 60-69 | Below standard, remediation required |\n| F | 0-59 | Failing, immediate action required |\n\n## Recommendations\n\n1. **Immediate:** Address CRITICAL typosquatting suspects\n2. **Short-term:** Evaluate alternatives for single-maintainer deps\n3. **Medium-term:** Declare phantom dependencies explicitly\n4. **Long-term:** Upgrade stale dependencies and improve SLSA level\n```\n\n## Error Handling\n\n| Scenario | Action |\n|----------|--------|\n| Registry API unavailable | Skip that capability, continue with others, note in report |\n| No manifest file found | Report error and exit |\n| No dependencies declared | Report score 100, grade A, zero findings |\n| EPSS API unavailable | Skip EPSS scoring, continue with other capabilities |\n| AST scan fails for language | Skip phantom detection, note unsupported language |\n| Rate limited by registry | Implement exponential backoff, partial results if timeout |\n\n## Integration Notes\n\n| Skill | Relationship | Context |\n|-------|-------------|---------|\n| `x-audit-dependencies` | complementary | Handles CVEs, outdated versions, licenses, and SBOM generation |\n| `x-generate-security-dashboard` | reads | Dashboard aggregates results from this skill |\n| `x-generate-ci` | called-by | Security pipeline may invoke supply chain audit |\n\n## Knowledge Pack References\n\n| Pack | Files | Purpose |\n|------|-------|---------|\n| security | `knowledge\u002Fsecurity\u002Fsarif-template.md` | SARIF 2.1.0 output format |\n| security | `knowledge\u002Fsecurity\u002Fsecurity-scoring.md` | Scoring model and grade scale |\n| security | `knowledge\u002Fsecurity\u002Fsupply-chain-hardening.md` | SLSA framework and hardening patterns |\n| security | `knowledge\u002Fsecurity\u002Fsbom-generation-guide.md` | SBOM format reference |\n","## Global Output Policy\n\n- **Language**: English ONLY.\n- **Tone**: Technical, Direct, and Concise.\n- **Efficiency**: Remove all conversational fillers and greetings to save tokens.\n\n# Skill: Enhanced Supply Chain Audit\n\n## Purpose\n\nPerforms advanced supply chain security analysis for {{PROJECT_NAME}} that complements (does NOT replace) the existing `x-audit-dependencies` skill. While `x-audit-dependencies` focuses on known CVEs, outdated versions, and license compliance, this skill identifies deeper supply chain risks: single-maintainer dependencies, typosquatting suspects, phantom dependencies, stale packages, EPSS exploit prediction, and SLSA integrity assessment.\n\n## Relationship with x-audit-dependencies\n\n| Capability | x-audit-dependencies | x-audit-supply-chain |\n|------------|-------------------|----------------------|\n| Known CVEs | Yes | No (defers to x-audit-dependencies) |\n| Outdated versions | Yes | No (defers to x-audit-dependencies) |\n| License compliance | Yes | Extends with copyleft risk scoring |\n| SBOM generation | Yes (CycloneDX) | No (defers to x-audit-dependencies) |\n| Maintainer risk | No | Yes (bus factor analysis) |\n| Typosquatting | No | Yes (Levenshtein distance) |\n| Phantom dependencies | No | Yes (AST scan vs manifest diff) |\n| Dependency age | No | Yes (registry metadata) |\n| EPSS scoring | No | Yes (FIRST.org API) |\n| SLSA assessment | No | Yes (provenance verification) |\n| Risk scoring | Basic (severity only) | Multi-dimensional (5 weighted factors) |\n\nBoth skills can be executed independently. Results from both feed into the security dashboard.\n\n## Triggers\n\n- `\u002Fx-audit-supply-chain` — full supply chain audit (all 6 capabilities)\n- `\u002Fx-audit-supply-chain --depth deep` — deep analysis including transitive dependencies\n- `\u002Fx-audit-supply-chain --focus maintainer` — maintainer risk analysis only\n- `\u002Fx-audit-supply-chain --focus typosquatting` — typosquatting detection only\n- `\u002Fx-audit-supply-chain --focus phantom` — phantom dependency detection only\n- `\u002Fx-audit-supply-chain --focus age` — dependency age analysis only\n- `\u002Fx-audit-supply-chain --focus epss` — EPSS exploit prediction only\n- `\u002Fx-audit-supply-chain --focus slsa` — SLSA level assessment only\n- `\u002Fx-audit-supply-chain --risk-threshold 50` — filter findings below score 50\n- `\u002Fx-audit-supply-chain --include-dev-deps` — include dev dependencies\n\n## Parameters\n\n| Parameter | Type | Default | Validation | Description |\n|-----------|------|---------|------------|-------------|\n| `--depth` | String | shallow | enum: shallow, deep | shallow = direct deps only; deep = includes transitive |\n| `--include-dev-deps` | boolean | false | — | Include development dependencies in analysis |\n| `--risk-threshold` | int | 0 | 0-100 | Exclude findings with risk score below this value |\n| `--focus` | String | all | enum: all, maintainer, typosquatting, phantom, age, epss, slsa | Analyze specific risk category only |\n\n## Workflow\n\n```\n1. DETECT      -> Identify build tool and parse manifest\n2. RESOLVE     -> Build dependency graph (direct + transitive)\n3. ANALYZE     -> Run 6 parallel analysis capabilities\n4. SCORE       -> Calculate weighted risk score per dependency\n5. FILTER      -> Apply risk-threshold and focus filters\n6. REPORT      -> Generate SARIF 2.1.0 + Markdown report\n```\n\n### Step 1 — Detect Build Tool and Parse Manifest\n\nThe project uses **{{BUILD_TOOL}}** as its build tool. Parse the dependency manifest:\n\n| Build Tool | Manifest File | Lock File |\n|-----------|--------------|-----------|\n| npm | package.json | package-lock.json |\n| yarn | package.json | yarn.lock |\n| pnpm | package.json | pnpm-lock.yaml |\n| maven | pom.xml | — |\n| gradle | build.gradle \u002F build.gradle.kts | gradle.lockfile |\n| cargo | Cargo.toml | Cargo.lock |\n| pip | requirements.txt \u002F pyproject.toml | requirements.txt |\n| poetry | pyproject.toml | poetry.lock |\n| go mod | go.mod | go.sum |\n\n### Step 2 — Resolve Dependency Graph\n\nBuild the full dependency graph distinguishing direct vs transitive:\n\n| Build Tool | Command |\n|-----------|---------|\n| npm | `npm ls --all --json` |\n| maven | `mvn dependency:tree -DoutputType=text` |\n| gradle | `gradle dependencies --configuration runtimeClasspath` |\n| cargo | `cargo tree --format {p}:{l}` |\n| pip | `pipdeptree --json` |\n| poetry | `poetry show --tree` |\n| go mod | `go mod graph` |\n\n### Step 3 — Analysis Capabilities\n\n#### 3.1 — Maintainer Risk Analysis\n\nIdentify dependencies with single-maintainer risk (bus factor = 1):\n\n| Registry | API Endpoint | Maintainer Field |\n|----------|-------------|-----------------|\n| npm | `https:\u002F\u002Fregistry.npmjs.org\u002F{pkg}` | `maintainers[]` |\n| Maven Central | `https:\u002F\u002Fsearch.maven.org\u002Fsolrsearch\u002Fselect?q=a:{artifact}` | POM developers section |\n| PyPI | `https:\u002F\u002Fpypi.org\u002Fpypi\u002F{pkg}\u002Fjson` | `info.maintainers[]` |\n| crates.io | `https:\u002F\u002Fcrates.io\u002Fapi\u002Fv1\u002Fcrates\u002F{pkg}` | `crate.owners[]` |\n| Go | Module repository metadata | — |\n\n**Scoring:**\n- 1 maintainer: risk = 100 (HIGH severity)\n- 2-3 maintainers: risk = 50 (MEDIUM severity)\n- 4+ maintainers: risk = 0 (no risk)\n\n#### 3.2 — Typosquatting Detection\n\nDetect dependency names suspiciously similar to popular packages using Levenshtein distance:\n\n1. For each dependency, compute Levenshtein distance against a known list of popular packages for the ecosystem\n2. Flag packages with distance \u003C 2 from a popular package\n3. Popular package lists per ecosystem:\n\n| Registry | Popular Packages Source |\n|----------|----------------------|\n| npm | Top 1000 by weekly downloads |\n| Maven Central | Top artifacts by usage |\n| PyPI | Top 1000 by monthly downloads |\n| crates.io | Top crates by downloads |\n\n**Scoring:**\n- Levenshtein distance = 1: risk = 100 (CRITICAL severity)\n- Same name different scope\u002Forg: risk = 75 (HIGH severity)\n\n#### 3.3 — Phantom Dependency Detection\n\nIdentify imports in source code that are not declared in the manifest:\n\n1. Scan source files for import statements:\n\n| Language | Import Pattern |\n|----------|---------------|\n| Java\u002FKotlin | `import {package}.{Class}` |\n| TypeScript\u002FJS | `import ... from '{module}'` \u002F `require('{module}')` |\n| Python | `import {module}` \u002F `from {module} import ...` |\n| Go | `import \"{module}\"` |\n| Rust | `use {crate}::...` \u002F `extern crate {name}` |\n\n2. Cross-reference detected imports against declared dependencies in manifest\n3. Flag imports that resolve to undeclared dependencies\n\n**Scoring:**\n- Phantom dependency found: risk = 75 (MEDIUM severity)\n\n#### 3.4 — Dependency Age Analysis\n\nCheck time since last release for each dependency:\n\n| Registry | Last Release API |\n|----------|-----------------|\n| npm | `https:\u002F\u002Fregistry.npmjs.org\u002F{pkg}` -> `time.modified` |\n| Maven Central | `https:\u002F\u002Fsearch.maven.org\u002Fsolrsearch\u002Fselect` -> `timestamp` |\n| PyPI | `https:\u002F\u002Fpypi.org\u002Fpypi\u002F{pkg}\u002Fjson` -> `urls[].upload_time` |\n| crates.io | `https:\u002F\u002Fcrates.io\u002Fapi\u002Fv1\u002Fcrates\u002F{pkg}` -> `crate.updated_at` |\n\n**Scoring:**\n- Last release > 2 years: risk = 100 (HIGH severity)\n- Last release 1-2 years: risk = 75 (MEDIUM severity)\n- Last release 6-12 months: risk = 25 (LOW severity)\n- Last release \u003C 6 months: risk = 0 (no risk)\n\n#### 3.5 — EPSS Scoring (Exploit Prediction)\n\nQuery FIRST.org EPSS API for exploit probability of known CVEs:\n\n- **API:** `https:\u002F\u002Fapi.first.org\u002Fdata\u002Fv1\u002Fepss?cve={CVE-ID}`\n- **Response field:** `epss` (probability 0.0-1.0 of exploit within 30 days)\n\n**Scoring:**\n- EPSS >= 0.5: risk = 100 (CRITICAL severity — high probability of exploit)\n- EPSS 0.1-0.49: risk = 75 (HIGH severity)\n- EPSS 0.01-0.09: risk = 50 (MEDIUM severity)\n- EPSS \u003C 0.01: risk = 25 (LOW severity)\n\n#### 3.6 — SLSA Assessment\n\nEvaluate Supply-chain Levels for Software Artifacts compliance:\n\n| SLSA Level | Requirements | Score |\n|-----------|-------------|-------|\n| SLSA 0 | No guarantees | risk = 100 |\n| SLSA 1 | Build process documented | risk = 75 |\n| SLSA 2 | Hosted build, signed provenance | risk = 50 |\n| SLSA 3 | Hardened builds, non-falsifiable provenance | risk = 25 |\n\nCheck for:\n- Signed releases \u002F provenance attestations\n- Reproducible builds\n- Build system documentation\n- Source-to-build mapping\n\n### Step 4 — Risk Scoring\n\nCalculate weighted risk score for each dependency:\n\n```\nrisk_score = (cve_severity * 0.40)\n           + (depth_score * 0.20)\n           + (maintainer_risk * 0.15)\n           + (license_risk * 0.15)\n           + (popularity_inverse * 0.10)\n```\n\n**Factor Ranges (all 0-100):**\n\n| Factor | Calculation |\n|--------|------------|\n| cve_severity | CVSS score normalized to 0-100 |\n| depth_score | direct = 100, depth 1 = 75, depth 2 = 50, depth 3+ = 25 |\n| maintainer_risk | single = 100, 2-3 = 50, 4+ = 0 |\n| license_risk | copyleft = 100, weak-copyleft = 50, permissive = 0, unknown = 75 |\n| popularity_inverse | downloads \u003C 1000\u002Fweek = 100, \u003C 10000 = 50, >= 10000 = 0 |\n\n**Severity Classification:**\n\n| Risk Score | Severity |\n|-----------|----------|\n| 80-100 | CRITICAL |\n| 60-79 | HIGH |\n| 40-59 | MEDIUM |\n| 20-39 | LOW |\n| 0-19 | INFO |\n\n### Step 5 — Apply Filters\n\n1. If `--focus` is not `all`, include only findings matching the specified `riskCategory`\n2. If `--risk-threshold` > 0, exclude findings with `riskScore` below the threshold\n3. If `--include-dev-deps` is false, exclude dev\u002Ftest-scoped dependencies\n4. If `--depth` is `shallow`, exclude transitive dependencies\n\n### Step 6 — Generate Reports\n\n#### 6.1 — SARIF 2.1.0 Output\n\nWrite SARIF to `results\u002Faudits\u002Fsupply-chain-audit-YYYY-MM-DD.sarif.json`:\n\nFollow the SARIF template from `knowledge\u002Fsecurity\u002Fsarif-template.md`. Use tool name `x-audit-supply-chain` and rule IDs:\n\n| Rule ID | Name | Category |\n|---------|------|----------|\n| SCA-MAINT-001 | SingleMaintainerDependency | maintainer |\n| SCA-TYPO-001 | TyposquattingSuspect | typosquatting |\n| SCA-PHANTOM-001 | PhantomDependency | phantom |\n| SCA-AGE-001 | StaleDependency | age |\n| SCA-EPSS-001 | HighExploitProbability | epss |\n| SCA-SLSA-001 | LowSlsaLevel | slsa |\n\n#### 6.2 — Markdown Report\n\nWrite report to `results\u002Faudits\u002Fsupply-chain-audit-YYYY-MM-DD.md`:\n\n```markdown\n# Supply Chain Audit Report — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Build Tool:** {{BUILD_TOOL}}\n**Depth:** {shallow|deep}\n**Focus:** {focus}\n\n## Summary\n\n| Metric | Value |\n|--------|-------|\n| Overall Score | {overallScore}\u002F100 |\n| Grade | {grade} |\n| Total Dependencies | {totalDependencies} |\n| Direct Dependencies | {directDependencies} |\n| Transitive Dependencies | {transitiveDependencies} |\n\n## Risk Distribution\n\n| Category | Count | Highest Severity |\n|----------|-------|-----------------|\n| Maintainer Risk | {singleMaintainerCount} | {severity} |\n| Typosquatting Suspects | {typosquattingSuspects} | {severity} |\n| Phantom Dependencies | {phantomDependencies} | {severity} |\n| Stale Dependencies | {staleDependencies} | {severity} |\n| EPSS High Risk | {epssHighRisk} | {severity} |\n| SLSA Level | {slsaLevel} | {severity} |\n\n## Findings\n\n### [SCA-MAINT-001] {packageName}@{version}\n- **Category:** Maintainer Risk\n- **Risk Score:** {riskScore}\u002F100\n- **Severity:** {severity}\n- **Detail:** {detail}\n- **Recommendation:** {fixRecommendation}\n\n### [SCA-TYPO-001] {packageName}@{version}\n- **Category:** Typosquatting\n- **Risk Score:** {riskScore}\u002F100\n- **Severity:** CRITICAL\n- **Detail:** Name similar to \"{popularPackage}\" (Levenshtein distance: {distance})\n- **Recommendation:** Verify the correct package is being used\n\n## Scoring Methodology\n\nRisk Score = (CVE Severity * 0.40) + (Depth * 0.20)\n           + (Maintainer * 0.15) + (License * 0.15)\n           + (Popularity * 0.10)\n\n## Grade Scale\n\n| Grade | Score Range | Description |\n|-------|------------|-------------|\n| A | 90-100 | Excellent supply chain posture |\n| B | 80-89 | Good posture with minor risks |\n| C | 70-79 | Acceptable but improvement needed |\n| D | 60-69 | Below standard, remediation required |\n| F | 0-59 | Failing, immediate action required |\n\n## Recommendations\n\n1. **Immediate:** Address CRITICAL typosquatting suspects\n2. **Short-term:** Evaluate alternatives for single-maintainer deps\n3. **Medium-term:** Declare phantom dependencies explicitly\n4. **Long-term:** Upgrade stale dependencies and improve SLSA level\n```\n\n## Error Handling\n\n| Scenario | Action |\n|----------|--------|\n| Registry API unavailable | Skip that capability, continue with others, note in report |\n| No manifest file found | Report error and exit |\n| No dependencies declared | Report score 100, grade A, zero findings |\n| EPSS API unavailable | Skip EPSS scoring, continue with other capabilities |\n| AST scan fails for language | Skip phantom detection, note unsupported language |\n| Rate limited by registry | Implement exponential backoff, partial results if timeout |\n\n## Integration Notes\n\n| Skill | Relationship | Context |\n|-------|-------------|---------|\n| `x-audit-dependencies` | complementary | Handles CVEs, outdated versions, licenses, and SBOM generation |\n| `x-generate-security-dashboard` | reads | Dashboard aggregates results from this skill |\n| `x-generate-ci` | called-by | Security pipeline may invoke supply chain audit |\n\n## Knowledge Pack References\n\n| Pack | Files | Purpose |\n|------|-------|---------|\n| security | `knowledge\u002Fsecurity\u002Fsarif-template.md` | SARIF 2.1.0 output format |\n| security | `knowledge\u002Fsecurity\u002Fsecurity-scoring.md` | Scoring model and grade scale |\n| security | `knowledge\u002Fsecurity\u002Fsupply-chain-hardening.md` | SLSA framework and hardening patterns |\n| security | `knowledge\u002Fsecurity\u002Fsbom-generation-guide.md` | SBOM format reference |\n",{"name":5,"description":7,"allowed-tools":24,"argument-hint":25,"context-budget":26,"user-invocable":27,"requires-capabilities":28},"Read, Write, Bash, Grep, Glob","[--depth shallow|deep] [--include-dev-deps] [--risk-threshold 0-100] [--focus all|maintainer|typosquatting|phantom|age|epss|slsa]","medium",true,[],"main","952a630c6f38d193a349d86fa18db1de8843e837","src\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-neo4j\u002F.claude\u002Fskills\u002Fx-audit-supply-chain",1,"https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment","https:\u002F\u002Fgithub.com\u002Freview-bench","https:\u002F\u002Freview-bench.ai","An open benchmark for AI code review.","2026-10-27 06:56:37",{"source":8,"skillName":5,"commands":39,"prompt":49,"zipAvailable":27},[40,43,46],{"tool":41,"command":42},"npx","npx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-audit-supply-chain",{"tool":44,"command":45},"bunx","bunx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-audit-supply-chain",{"tool":47,"command":48},"pnpm","pnpm dlx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-audit-supply-chain","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-neo4j\u002F.claude\u002Fskills\u002Fx-audit-supply-chain\u002FSKILL.md",[51],{"path":52,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":55,"sourceHtmlUrl":56},"README.md","REFERENCE","参考文档",2367,"https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-neo4j\u002F.claude\u002Fskills\u002Fx-audit-supply-chain\u002FREADME.md",[58,65,72,79,86,93],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M757M8J48TQ1Y3X25GSJBXAS","x-parallel-eval","Detects and classifies file-collision risks between work units (tasks, stories, or epic phases) before parallel execution. Reads ## File Footprint blocks produced by x-task-plan \u002F x-story-plan, applies the parallelism-heuristics knowledge pack (hard \u002F regen \u002F soft categories + hotspot overrides), and emits a collision matrix + serialization recommendation in Markdown (default) or JSON.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fx-parallel-eval\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M757M57XMR9546S69466HDWT","parallelism-heuristics","Canonical catalog of file-collision heuristics for parallel task, story, and epic execution. Defines the File Footprint block format, the three Conflict Categories (hard \u002F regen \u002F soft), a hotspot list of high-contention paths, and the degrade-with-warning policy. Consumed by x-task-plan, x-story-plan, x-epic-map, x-parallel-eval, and x-dev-*-implement.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fparallelism-heuristics\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M757M11SZ8P1VCQABT08QVYA","x-watch-pr-ci","Polls a PR's CI checks and Copilot review status, blocking until checks complete or timeout. Returns one of 8 stable exit codes (SUCCESS=0, CI_PENDING_PROCEED=10, CI_FAILED=20, TIMEOUT=30, PR_ALREADY_MERGED=40, NO_CI_CONFIGURED=50, PR_CLOSED=60, PR_NOT_FOUND=70). Writes a versioned state-file for session resume.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-watch-pr-ci\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M757KW53K8KFPGADFB4PH949","x-validate-docs","Documentation freshness gate: validates 6 dimensions (readme, api-specs, grpc-proto, adr, skill-docs, system-architecture) against code changes in a PR. Stack-aware — only validates targets declared\u002Fauto-detected from ProjectConfig.documentation.targets. Returns exit non-zero on staleness; produces structured report.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-validate-docs\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M757KQZHSA10MKC0CR571D60","x-update-system-architecture","Incrementally updates docs\u002Farchitecture\u002Fsystem.md after an epic completes. Appends new entries to the Decision Log (§11) using x-internal-write-report --append (dedup by ## ID: marker) and surgically inserts component\u002Fintegration changes into sections 1-10 via Edit. Idempotent: re-running with the same epic produces a byte-identical system.md.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-update-system-architecture\u002FSKILL.md",[],[],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":19},"01M757KKBT5Q1SVF8DMJBVF46M","x-update-architecture","Incrementally updates the service architecture document with changes from architecture plans. Adds new components, integrations, flows, and ADR references without rewriting existing content. Use after implementation to keep architecture documentation current.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-update-architecture\u002FSKILL.md",[],[]]