plugin

Supply Chain Risk Auditor (Trail of Bits)

Audit npm, PyPI and Go dependencies for supply-chain risk

.mdHow to install

Audits npm, PyPI and Go dependencies for version-matched advisories, abandoned upstreams, publisher concentration and install scripts. Part of the Trail of Bits skills marketplace (44 plugins), a Claude Code plugin marketplace that Codex can load through its Claude marketplace compatibility.

Install

  1. 1Add it in ChatGPT

    Open Plugins in the ChatGPT sidebar (web or desktop), search for “Supply Chain Risk Auditor (Trail of Bits)” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.

  2. 2Or install it in Codex
    codex plugin marketplace add trailofbits/skills
codex plugin add supply-chain-risk-auditor@trailofbits

    Start a new Codex session afterwards. You can also run /plugins inside the CLI to browse and install interactively.

Things to ask

  • “Audit this project's dependencies for supply-chain risk”
  • “Which of our npm packages run install scripts?”
  • “Find abandoned upstream dependencies in requirements.txt”

Learn more

ChatGPT plugin and MCP server security checklistCheck these before installing a ChatGPT plugin or MCP server: publisher, OAuth scopes, write actions, prompt injection, data retention and admin controls.7 min read

Related

Codex SecuritySecurity scanning for your codebaseplugin · by OpenAI · 7.2k starsGitHubTriage PRs, issues, CI, and publish flowsplugin · by OpenAI · 7.2k starsTemporalDevelop with Temporalplugin · by Temporal · 7.2k starsCircleCIBuild, test, and deploy any applicationplugin · by CircleCI · 7.2k starsCloudflareCloudflare platform guidance with official MCPplugin · by Cloudflare · 7.2k starsSentryInspect recent Sentry issues and eventsplugin · by OpenAI · 7.2k stars