supply-chain-audit

Supply Chain Audit

Standalone skill for analyzing the supply chain threat landscape of a project's direct dependencies.

Load skills: zsh-compat

Usage

/rune:supply-chain-audit                    # Auto-detect package manager, analyze all
/rune:supply-chain-audit --max 20           # Limit to 20 dependencies
/rune:supply-chain-audit --manager npm      # Force specific package manager

Flags

Flag	Effect
--max N	Maximum dependencies to analyze (default: 50, from talisman)
--manager TYPE	Force package manager: npm, pip, cargo, go, composer

Workflow

const args = "$ARGUMENTS".trim()
const maxFlag = args.match(/--max\s+(\d+)/)
const managerFlag = args.match(/--manager\s+(\w+)/)

// Read talisman config
// readTalismanSection: "misc"
const talismanMisc = readTalismanSection("misc") ?? {}
const supplyChainConfig = talismanMisc.supply_chain ?? {}

if (supplyChainConfig.enabled === false) {
  log("Supply chain audit is disabled in talisman. Set supply_chain.enabled: true to enable.")
  return
}

const maxDeps = maxFlag ? parseInt(maxFlag[1]) : (supplyChainConfig.max_dependencies ?? 50)
const riskThreshold = supplyChainConfig.risk_threshold ?? "medium"

// Step 1: Auto-detect package manager
const manifests = {
  npm: "package.json",
  pip: ["requirements.txt", "pyproject.toml"],
  cargo: "Cargo.toml",
  go: "go.mod",
  composer: "composer.json"
}

let detectedManagers = []
if (managerFlag) {
  detectedManagers = [managerFlag[1]]
} else {
  // Scan for manifest files
  for (const [manager, files] of Object.entries(manifests)) {
    const fileList = Array.isArray(files) ? files : [files]
    for (const f of fileList) {
      if (Glob(f).length > 0) {
        detectedManagers.push(manager)
        break
      }
    }
  }
}

if (detectedManagers.length === 0) {
  log("No package manifest files found. Supply chain audit requires package.json, requirements.txt, Cargo.toml, go.mod, or composer.json.")
  return
}

log(`Detected package managers: ${detectedManagers.join(", ")}`)

// Step 2: Extract dependencies per manager
let allDeps = []

for (const manager of detectedManagers) {
  let deps = []
  switch (manager) {
    case "npm":
      // Read package.json, extract .dependencies keys
      const pkg = JSON.parse(Read("package.json"))
      deps = Object.keys(pkg.dependencies || {}).map(name => ({
        name, version: pkg.dependencies[name], manager: "npm"
      }))
      break
    case "pip":
      // Read requirements.txt, strip version specifiers
      const reqFile = Glob("requirements.txt").length > 0 ? "requirements.txt" : null
      if (reqFile) {
        const lines = Read(reqFile).split("\n")
          .filter(l => l.trim() && !l.startsWith("#") && !l.startsWith("-"))
          .map(l => ({ name: l.replace(/[>=<!\[].*$/, "").trim(), version: "*", manager: "pip" }))
        deps = lines
      }
      break
    case "cargo":
      // Parse Cargo.toml [dependencies]
      const cargoContent = Read("Cargo.toml")
      const depSection = cargoContent.match(/\[dependencies\]([\s\S]*?)(?:\[|$)/)?.[1] || ""
      deps = depSection.split("\n")
        .filter(l => l.includes("="))
        .map(l => ({ name: l.split("=")[0].trim().replace(/"/g, ""), version: l.split("=")[1]?.trim(), manager: "cargo" }))
      break
    case "go":
      // Parse go.mod require block
      const goContent = Read("go.mod")
      const requireBlock = goContent.match(/require \(([\s\S]*?)\)/)?.[1] || ""
      deps = requireBlock.split("\n")
        .filter(l => l.trim())
        .map(l => {
          const parts = l.trim().split(/\s+/)
          return { name: parts[0], version: parts[1], manager: "go" }
        })
      break
    case "composer":
      const composer = JSON.parse(Read("composer.json"))
      deps = Object.keys(composer.require || {})
        .filter(n => n !== "php" && !n.startsWith("ext-"))
        .map(name => ({ name, version: composer.require[name], manager: "composer" }))
      break
  }
  allDeps = allDeps.concat(deps)
}

// Cap at maxDeps
if (allDeps.length > maxDeps) {
  log(`Found ${allDeps.length} dependencies, capping at ${maxDeps}`)
  allDeps = allDeps.slice(0, maxDeps)
}

log(`Analyzing ${allDeps.length} dependencies...`)

// Step 3: For each dependency, query registry + GitHub for risk signals
// Uses gh api for GitHub data, npm view / curl for registry data
// Scores across 6 risk dimensions per the supply-chain-sentinel agent protocol

// Step 4: Generate structured risk report
// Output format matches supply-chain-sentinel output with risk summary table

// Step 5: For P1/P2 findings, suggest alternatives via WebSearch (if available)

// Present final report to user

Risk Dimensions

Dimension	Weight	P1 Threshold	P2 Threshold	P3 Threshold
Maintainer count	25%	0-1 maintainers	2-3 maintainers	—
Last commit date	25%	>24 months	12-24 months	6-12 months
CVE history	20%	Unpatched CVEs	3+ CVEs/2yr	1-2 CVEs/2yr
Download trajectory	10%	—	>50% decline	>25% decline
Bus factor	10%	>90% single	>70% single	>50% single
Security policy	10%	—	—	Missing SECURITY.md

Severity Mapping

• P1 (Critical): Abandoned package with known CVEs, or composite score >= 0.7
• P2 (High): Single maintainer, or abandoned (>12mo), or composite score >= 0.4
• P3 (Medium): Weak signals only, composite score >= 0.2

Output

The skill produces a formatted risk report directly in the conversation with:

• Risk summary table (all dependencies)
• Detailed findings for P1/P2/P3 dependencies
• Alternative package suggestions for high-risk dependencies
• Packages that could not be analyzed (API failures)

Talisman Configuration

# .rune/talisman.yml
supply_chain:
  enabled: true              # Enable supply chain analysis
  max_dependencies: 50       # Cap on dependencies to analyze
  risk_threshold: "medium"   # Minimum risk level to report: low|medium|high
  registries:                # Override registry API endpoints (optional)
    npm: "https://registry.npmjs.org"
    pypi: "https://pypi.org/pypi"

Error Handling

Error	Recovery
gh CLI not available	Fall back to unauthenticated API calls (60 req/hr limit)
Registry API failure	Mark dependency as UNCERTAIN, continue with others
GitHub API rate limit	Stop GitHub queries, report partial results
No manifest files found	Report and exit gracefully
Private/scoped packages	Skip with note (cannot query public registries)