What is supply-chain-audit?

A review of the software supply chain: the packages, container images, build tools, CI/CD systems, and processes used to turn source code into a deployed product. It checks whether those inputs and steps can be trusted and reproduced.

Use it to review lockfiles, dependency vulnerabilities, software bills of materials (SBOMs), container base images, commit signing, secret exposure in history, and CI/CD integrity. It can apply low-risk configuration fixes, while dependency upgrades need confirmation.

Problems in dependencies or build systems can introduce vulnerabilities before application security checks see them. The review finds weaknesses such as unpinned dependencies, unsafe CI settings, or missing vulnerability checks.

supply-chain-audit — Skill for Claude Code and Codex by Nordic-AI

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add Nordic-AI/production-readiness-skills --skill supply-chain-audit

Clone the repo

git clone --depth 1 https://github.com/Nordic-AI/production-readiness-skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/nordic-ai/production-readiness-skills/supply-chain-audit/github.svg)](https://agentmods.dev/skills/nordic-ai/production-readiness-skills/supply-chain-audit)

Your own site

<a href="https://agentmods.dev/skills/nordic-ai/production-readiness-skills/supply-chain-audit"><img src="https://agentmods.dev/badge/skills/nordic-ai/production-readiness-skills/supply-chain-audit/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/nordic-ai/production-readiness-skills/supply-chain-audit"><img src="https://agentmods.dev/badge/skills/nordic-ai/production-readiness-skills/supply-chain-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 104 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 4,188 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00104	$0.04188
Opus 5	$0.00052	$0.02094
Sonnet 5	$0.00021	$0.00838
Haiku 4.5	$0.00010	$0.00419

Measured 12d ago against content hash ef2691e9b345, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

supply-chain-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- **Minimal layers with known package sources** — curl piped to bash → finding.

skills/supply-chain-audit/SKILL.md · 348 lines

How it starts

The opening of the file, as written. The whole thing — 348 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Supply Chain Audit

You review the trust boundary between the project and everything it pulls in — packages, container base images, CI actions, build tools, commit signing, and the integrity of the path from source to deployed artifact.

Supply-chain incidents (event-stream, Codecov, SolarWinds, xz-utils) are often more damaging than application-level bugs because they bypass the application's own defenses.

Inputs

From orchestrator: scope_tier, stack_summary, gitnexus_indexed, deployment target.

Mode detection

Plan mode — report supply-chain gaps with fix recommendations.
Edit mode — apply low-risk config fixes (lockfile generation, .npmrc hardening, base image pinning by digest). Dependency upgrades require per-change confirmation — they're the highest-risk edits.

Thresholds by tier

Tier	Lockfile	Vuln scanning	SBOM	Signing	CI hardening
prototype	required	advisory	optional	optional	basic
team	required + committed + CI-gated	required on PRs	recommended	commits signed by contributors	secrets in vault, pinned actions
scalable	required + reproducible install	required + policy	required on artifacts	required on artifacts + provenance	required — pinned actions by SHA, isolated runners, SLSA level ≥2

Review surface

1. Dependency manifests and lockfiles

Check per ecosystem:

npm / pnpm / yarn — package.json present? package-lock.json / pnpm-lock.yaml / yarn.lock committed?
- npm ci used in CI, not npm install.
- No ^ / ~ in a published library's peer deps (too loose).
- overrides / resolutions for transitive security pins documented.
Python — pyproject.toml + lockfile (poetry.lock, uv.lock, pdm.lock, pipenv.lock, or requirements.txt with hashes via pip-compile --generate-hashes).
- Unpinned requirements.txt with only top-level packages → finding.
- --require-hashes at install time for scalable tier.
Go — go.mod + go.sum committed. GOFLAGS=-mod=vendor or explicit vendor/ if fully vendored.
Rust — Cargo.lock committed (always for binaries, and for libs too at scalable tier).
Java — Maven pom.xml with pinned versions (not LATEST, RELEASE, version ranges); consider maven-enforcer-plugin with requireUpperBoundDeps. Gradle: dependencyLocking.
Ruby — Gemfile.lock committed.
.NET — packages.lock.json with RestorePackagesWithLockFile.
PHP — composer.lock committed.

Read the full file on GitHub · 348 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 348 lines · 104 tokens per session scan A ef2691e9b345

Subscribe to this mod's changes

supply-chain-audit is a skill published in the GitHub repository Nordic-AI/production-readiness-skills (2 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 104 tokens to every session and 4,188 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

CI and CD Claude Code Containers DevOps and cloud Security claude-skills compliance eu-ai-act gdpr

devops-engineer

Creates Dockerfiles, configures CI/CD pipelines, writes Kubernetes manifests, and generates Terraform/Pulumi infrastructure templates. Handles deployment automation, GitOps configuration, incident response runbooks, and internal developer platform tooling. Use when setting up CI/CD pipelines, containerizing…

Jeffallan/claude-skills · 107 tokens

fedramp

Expert guidance for FedRAMP certification and compliance under CR26 (FedRAMP Consolidated Rules for 2026). Use this skill whenever a user asks about FedRAMP authorization, ATO (Authority to Operate), cloud security for federal government, NIST SP 800-53 controls, CSP compliance, or any of the core FedRAMP document…

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance · 236 tokens

gdpr-compliance

Expert GDPR compliance assistant covering all four core workflows: (1) auditing code and systems for GDPR violations, (2) drafting GDPR-compliant documents such as privacy policies, Data Processing Agreements (DPAs), and consent notices, (3) answering GDPR compliance questions with authoritative article citations, and…

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance · 176 tokens

iso42001

Expert ISO 42001 AI Management System (AIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 42001:2023, AI governance, AI management systems, AI risk assessment, AI system impact assessment, Annex A controls for AI, Statement of Applicability for AI systems, AI policy, responsible AI, AI…

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance · 173 tokens

eu-cra

Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU. Use this skill for gap analysis, product classification (Default / Class I / Class II), conformity assessment route…

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance · 133 tokens

nist-800-53

NIST SP 800-53 Rev 5 compliance advisor — all 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR), Low/Moderate/High baseline selection, FIPS 199/200 system categorization, control tailoring and overlays, privacy controls (PT family), supply chain risk management (SR…

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance · 177 tokens

supply-chain-audit