supply-chain-risk-auditor

Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-party package risk, or review a dependency tree before an engagement.

Agent Skill from trailofbits/skills

Copilot Studio

Passes documented load rules

No documented load rule failed.

Microsoft 365 Copilot Preview, Frontier tenants only

Needs changes

Fails: Every file has a supported file type (M365-FILE-TYPES)
3 unsupported: assets/trail-of-bits-mark.svg, scripts/pyproject.toml, scripts/uv.lock
rule · Microsoft 365 Copilot: Supported file and script types

Warnings (don't change the verdict):

Warning: No sign of network access, package installs or authenticated calls (M365-SANDBOX)
SKILL.md mentions JS HTTP client, npm/npx install
rule · Microsoft 365 Copilot: Script execution sandbox
Warning: No sign of network access, package installs or authenticated calls (M365-SANDBOX)
declares dependencies (scripts/pyproject.toml); the sandbox can't install packages
rule · Microsoft 365 Copilot: Script execution sandbox
Warning: No sign of network access, package installs or authenticated calls (M365-SANDBOX)
scripts: scripts/collect.py (JS HTTP client, npm/npx install); scripts/model.py (JS HTTP client); scripts/render.py (JS HTTP client); scripts/sources.py (Python HTTP client, credentials / authenticated call); scripts/test_render.py (npm/npx install)
rule · Microsoft 365 Copilot: Script execution sandbox

An agent can have at most 8 skills. Custom skills aren't available in tenants that use Microsoft Purview Information Barriers.

Agent Skills spec notes

Warning: No experimental allowed-tools field (SPEC-ALLOWED-TOOLS)
uses allowed-tools
rule · Agent Skills specification

Compatible isn't the same as safe. These verdicts only say whether a skill's files follow Microsoft's documented load rules. The checker reads files and never runs them, and it doesn't review what a skill or its scripts actually do. Read a skill's instructions and scripts before you add it to an agent.

Standards signals

Meets the agentskills.io required fields.

Frontmatter	Present and parsed Spec: frontmatter
name	Meets the spec (1-64 chars, a-z 0-9 hyphens) Spec: name
description	Present, 1-1,024 characters Spec: description
compatibility	Absent or under 500 characters Spec: compatibility
Name matches folder	Yes (`supply-chain-risk-auditor`) Spec: name
allowed-tools	Used Note: experimental in the spec; support varies by agent. Spec: allowed-tools

Observed from the public SKILL.md at the commit above on 2026-10-23. Not a certification: AAIF and the Agent Skills project don't certify skills. Validate your own skill with skills-ref validate.

Source repo	trailofbits/skills
Path	plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor/SKILL.md
Commit checked	`1e0cb77d071a`
Repo license	CC · we list metadata only
Files	13
Scripts	8 (8 scanned for the sandbox heuristic)
Instructions	6,499 characters
Deepest folder	1 below the skill folder
Rules version	2026-10-22

Re-check the latest version How skill checks work

Is this wrong or out of date? Email us. Skills data built 2026-10-23; rules as of 2026-10-22.

Rule-based checks of public files against Microsoft's documented load rules, not tested in Copilot Studio or Microsoft 365 Copilot. Independent project, not affiliated with Microsoft.