# Supply Chain Risk Auditor (Trail of Bits) (ChatGPT Plugin)

> Audit npm, PyPI and Go dependencies for supply-chain risk

- Type: plugin
- Publisher: Trail of Bits
- Categories: Security, DevOps & Cloud
- Website: https://github.com/trailofbits/skills/tree/main/plugins/supply-chain-risk-auditor
- Docs: https://github.com/trailofbits/skills#codex
- Source: https://github.com/trailofbits/skills
- GitHub stars: 7320
- Listed: 2026-01-14

## About

Audits npm, PyPI and Go dependencies for version-matched advisories, abandoned upstreams, publisher concentration and install scripts. Part of the Trail of Bits skills marketplace (44 plugins), a Claude Code plugin marketplace that Codex can load through its Claude marketplace compatibility.

## Install

1. **Add it in ChatGPT** Open Plugins in the ChatGPT sidebar (web or desktop), search for “Supply Chain Risk Auditor (Trail of Bits)” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.

2. **Or install it in Codex**

   Codex CLI:

   ```bash
   codex plugin marketplace add trailofbits/skills
   codex plugin add supply-chain-risk-auditor@trailofbits
   ```

## Example prompts

- "Audit this project's dependencies for supply-chain risk"
- "Which of our npm packages run install scripts?"
- "Find abandoned upstream dependencies in requirements.txt"

## Related

- [Codex Security](https://chatgptplugins.directory/plugins/codex-security.md): Security scanning for your codebase
- [GitHub](https://chatgptplugins.directory/plugins/github.md): Triage PRs, issues, CI, and publish flows
- [Temporal](https://chatgptplugins.directory/plugins/temporal.md): Develop with Temporal
- [CircleCI](https://chatgptplugins.directory/plugins/circleci.md): Build, test, and deploy any application
- [Cloudflare](https://chatgptplugins.directory/plugins/cloudflare.md): Cloudflare platform guidance with official MCP
- [Sentry](https://chatgptplugins.directory/plugins/sentry.md): Inspect recent Sentry issues and events

---
Source: https://chatgptplugins.directory/plugins/trailofbits-supply-chain-risk-auditor · Index: https://chatgptplugins.directory/llms.txt · Independent and community-run. Not affiliated with or endorsed by OpenAI. ChatGPT is a trademark of OpenAI.