supply-chain-audit

Stars11

Forks2

UpdatedJune 14, 2026 at 15:38

Software supply chain audit — dependencies (CVEs, maintenance, licenses, transitive risk), build/CI integrity (SHA-pinned actions, lockfile, CI-only release), artifact integrity (checksums, signing, SBOM). Triggers on: "/supply-chain-audit", "supply-chain-audit", "dependency audit". Run before adding a dep, before a release, or for periodic review. Reports; does not change deps unless asked.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

HetCreep

HetCreep/CoalMine

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

3 files

SKILL.md

readonly

More from this repository

same repository

rot-canary

HetCreep/CoalMine

Code-health scan — dead code, bug-prone logic, resource leaks, concurrency bugs, silent failures, input-boundary issues, doc rot. Triggers on: "/rot-canary", "rot-canary", "code-health" (legacy aliases: "/rotcanary", "rotcanary"). Auto-runs at session end on touched files (QUICK, report only) via platform hooks — auto-wired by the Claude Code plugin, manual elsewhere. Run manually for fix mode. Reports; fixes on request via choice-gated menu.

World-class completeness audit — score a project's rules/standards/features against best-in-class exemplars, name the gaps, fill missing rules, adopt as binding, then offer to conform existing code. Triggers on keywords: "/gold-standard", "gold-standard", "audit rules", "are we world-class", "fill gaps", "complete our rules", "conform old code".

Compatibility and schema drift canary — checks for database schema migration safety, breaking API contract changes, serializable payload mismatches, and backward compatibility drift. Triggers on keywords: "/drift-canary", "drift-canary", "contract drift", "breaking changes". Use when changing DB schemas, API contracts, serialized payloads, or required config keys.

2026-07-2411

resilience-audit

HetCreep/CoalMine

Failure-mode audit (FMEA for software) — for each way the system can fail (network, storage, partial completion, crash, concurrency, bad input), check whether code DETECTS, HANDLES, RECOVERS, and COMMUNICATES it. Triggers on: "/resilience-audit", "resilience-audit", "FMEA audit". Use when touching network, storage, async, retry, or rollback paths. Flags data loss, silent-success-on-failure, missing rollback/retry/idempotency. Reports; does not fix unless asked.

2026-07-2411

name	supply-chain-audit
description	Software supply chain audit — dependencies (CVEs, maintenance, licenses, transitive risk), build/CI integrity (SHA-pinned actions, lockfile, CI-only release), artifact integrity (checksums, signing, SBOM). Triggers on: "/supply-chain-audit", "supply-chain-audit", "dependency audit". Run before adding a dep, before a release, or for periodic review. Reports; does not change deps unless asked.

Supply-Chain Audit

Audit what the project trusts: deps, build pipeline, shipped artifact. Report; do NOT change deps unless asked.

1. Dependencies

Scope — honor .coalmine.json packageManifests if set: scan exactly those manifest/lockfile paths; else infer by inspecting the repo.
CVEs — run ecosystem auditor; cross-check every hit in GHSA/OSV/NVD. Cite advisory ID + affected range + fixed version. (Invoke source-grounding — never from memory.)
Maintenance — last release, commit recency, bus-factor, archived/deprecated flag.
License — flag copyleft inside permissive project, missing/unknown license.
Transitive — full tree; name the parent to bump for a transitive fix.
Behavior — phone home? install scripts? unexpected egress?

2. Build / CI

CI-only release builds?
Actions pinned to commit SHA (not floating tag)?
Lockfile committed + enforced in CI?
Minimal token scope? No pull_request_target?

3. Artifact

SHA-256 checksums published for every binary?
Signed (Authenticode/GPG)? Gap documented honestly?
SBOM generated?
User can verify before running?

Tooling

Per-ecosystem vuln/license/outdated commands + offline fallback: read references/tooling.md when selecting scanners.

Discipline

Ground every CVE/fixed-version in an advisory. Never from memory.
Don't auto-change deps — report + recommend; user decides (bumps break builds).
State what was NOT scanned. Blocked network scans → lockfile inspection fallback (see references/tooling.md), mark live checks N-A.

Fix mode (choice-gated)

After the report, present via ask_question:

Pin safe now — commit already-present unchanged lockfile, pin CI action to current SHA, add missing checksum step. Each: checkpoint → apply → verify.
Let me pick — user-selected fixes only.
Report only — change nothing.

NEVER auto-fix: dep version bump, lockfile regen (re-resolves entire transitive tree).

Output