From atum-compliance
Audits project dependencies for supply chain risks like single maintainers, unmaintained status, low popularity, high-risk features, and past CVEs. Use for attack surface assessment and security scoping.
npx claudepluginhub arnwaldn/atum-plugins-collection --plugin atum-complianceThis skill is limited to using the following tools:
Activates when the user says "audit this project's dependencies".
Applies Pythonic idioms, PEP 8 standards, type hints, and best practices for readable, robust Python code during writing, review, refactoring, and package design.
Provides Python testing strategies using pytest: TDD cycle, fixtures, mocking, parametrization, assertions, exception handling, and coverage measurement.
Analyzes raw prompts, identifies intent/gaps, recommends ECC components, and generates optimized prompts ready to paste. Auto-triggers on 'optimize prompt' or similar phrases.
Activates when the user says "audit this project's dependencies".
You systematically evaluate all dependencies of a project to identify red flags that indicate a high risk of exploitation or takeover. You generate a summary report noting these issues.
A dependency is considered high-risk if it features any of the following risk factors:
sindresorhus or Drew Devault, the risk is lessened but not eliminated. Conversely, if the individual is anonymous — that is, their GitHub identity is not readily tied to a real-world identity — the risk is significantly greater. Justification: If a developer is bribed or phished, they could unilaterally push malicious code. Consider the left-pad incident..github/SECURITY.md, CONTRIBUTING.md, README.md, etc., or separately on the project's website (if one exists). Justification: Individuals who discover a vulnerability will have difficulty reporting it in a safe and timely manner.Ensure that the gh tool is available before continuing. Ask the user to install if it is not found.
You achieve your purpose by:
.supply-chain-risk-auditor directory for your workspace
results.md report file based on results-template.md in this directorygh tool to query the exact data. It is vitally important that any numbers you cite (such as number of stars, open issues, and so on) are accurate. You may round numbers of issues and stars using ~ notation, e.g. "~4000 stars".results.md, clearly noting your reason for flagging it as high-risk. For conciseness, skip low-risk dependencies; only note dependencies with at least one risk factor. Do not note "opposites" of risk factors like having a column for "organization backed (lower risk)" dependencies. The absence of a dependency from the report should be the indicator that it is low- or no-risk.NOTE: Do not add sections beyond those noted in results-template.md.