git:20260612.0519d7d to git:20260614.13e0a75

1 added, 0 removed. Audit A to A.

---

name: supply-chain-audit

description: >-

Software supply chain audit — dependencies (CVEs, maintenance, licenses, transitive risk), build/CI integrity (SHA-pinned actions, lockfile, CI-only release), artifact integrity (checksums, signing, SBOM). Triggers on: "/supply-chain-audit", "supply-chain-audit", "dependency audit". Run before adding a dep, before a release, or for periodic review. Reports; does not change deps unless asked.

---

# Supply-Chain Audit

Audit what the project trusts: deps, build pipeline, shipped artifact. Report; do NOT change deps unless asked.

## 1. Dependencies

+ - **Scope** — honor `.coalmine.json` `packageManifests` if set: scan exactly those manifest/lockfile paths; else infer by inspecting the repo.

- **CVEs** — run ecosystem auditor; cross-check every hit in GHSA/OSV/NVD. Cite advisory ID + affected range + fixed version. (Invoke source-grounding — never from memory.)

- **Maintenance** — last release, commit recency, bus-factor, archived/deprecated flag.

- **License** — flag copyleft inside permissive project, missing/unknown license.

- **Transitive** — full tree; name the parent to bump for a transitive fix.

- **Behavior** — phone home? install scripts? unexpected egress?

## 2. Build / CI

- CI-only release builds?

- Actions pinned to commit SHA (not floating tag)?

- Lockfile committed + enforced in CI?

- Minimal token scope? No `pull_request_target`?

## 3. Artifact

- SHA-256 checksums published for every binary?

- Signed (Authenticode/GPG)? Gap documented honestly?

- SBOM generated?

- User can verify before running?

## Tooling

Per-ecosystem vuln/license/outdated commands + offline fallback: read `references/tooling.md` when selecting scanners.

## Discipline

- Ground every CVE/fixed-version in an advisory. Never from memory.

- Don't auto-change deps — report + recommend; user decides (bumps break builds).

- State what was NOT scanned. Blocked network scans → lockfile inspection fallback (see `references/tooling.md`), mark live checks N-A.

## Fix mode (choice-gated)

After the report, present via `ask_question`:

- **Pin safe now** — commit already-present unchanged lockfile, pin CI action to current SHA, add missing checksum step. Each: checkpoint → apply → verify.

- **Let me pick** — user-selected fixes only.

- **Report only** — change nothing.

NEVER auto-fix: dep version bump, lockfile regen (re-resolves entire transitive tree).

## Output

Build+artifact checklist · Summary (counts + top fixes) · Not scanned