Secure the software supply chain from the consume side: ingest the SBOM, triage CVEs by reachability, pin dependencies with a deliberate update cadence, verify SLSA provenance, and defend against malicious packages.
Installs into .claude/skills of the current project.
Are you the author of Supply Chain Security?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/mcorbett51090-supply-chain-security)
---
name: supply-chain-security
description: "Secure the software supply chain from the consume side: ingest the SBOM, triage CVEs by reachability, pin dependencies with a deliberate update cadence, verify SLSA provenance, and defend against malicious packages."
---
# Supply-Chain Security (consume side)
**Purpose:** secure what the software is made of.
## Enumerate
Consume the **SBOM** (from devops-cicd). Include transitive deps — you can't patch what you can't see.
## Triage by reachability
A vulnerable function you never call is lower priority. Reachability analysis prevents advisory-drowning.
## Pin + update on policy
Lockfiles + pins for reproducibility; deliberate automated-update cadence gated by tests — never blind auto-merge.
## Verify & defend
SLSA **provenance verification** for critical artifacts; defend against **typosquat / dependency-confusion** (scoped registries, scrutinize new deps + install scripts).
