# Supply Chain Risk Auditor (Trail of Bits) (ChatGPT Plugin)

> Audit npm, PyPI and Go dependencies for supply-chain risk

- Type: plugin
- Publisher: Trail of Bits
- Categories: Security, DevOps & Cloud
- Website: https://github.com/trailofbits/skills/tree/main/plugins/supply-chain-risk-auditor
- Docs: https://github.com/trailofbits/skills#codex
- Source: https://github.com/trailofbits/skills
- GitHub stars: 7320
- Listed: 2026-01-14

## About

Audits npm, PyPI and Go dependencies for version-matched advisories, abandoned upstreams, publisher concentration and install scripts. Part of the Trail of Bits skills marketplace (44 plugins), a Claude Code plugin marketplace that Codex can load through its Claude marketplace compatibility.

## Install

1. **Add it in ChatGPT** Open Plugins in the ChatGPT sidebar (web or desktop), search for “Supply Chain Risk Auditor (Trail of Bits)” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.

2. **Or install it in Codex**

   Codex CLI:

   ```bash
   codex plugin marketplace add trailofbits/skills
   codex plugin add supply-chain-risk-auditor@trailofbits
   ```

## Disconnect or uninstall

1. **In ChatGPT** Disconnect an account in Settings → Apps or Plugins. To remove the plugin itself, open Supply Chain Risk Auditor (Trail of Bits) in the Plugin Directory and select Uninstall plugin. Uninstalling can disconnect every account connected through it, and plugins your workspace installs may not offer the option.

2. **In Codex**

   Codex CLI:

   ```bash
   codex plugin remove supply-chain-risk-auditor@trailofbits
   ```

## Example prompts

- "Audit this project's dependencies for supply-chain risk"
- "Which of our npm packages run install scripts?"
- "Find abandoned upstream dependencies in requirements.txt"

## Supply Chain Risk Auditor (Trail of Bits) alternatives

- [Codex Security](https://chatgptplugins.directory/plugins/codex-security.md): Security scanning for your codebase
- [GitHub](https://chatgptplugins.directory/plugins/github.md): Triage PRs, issues, CI, and publish flows
- [Temporal](https://chatgptplugins.directory/plugins/temporal.md): Develop with Temporal
- [CircleCI](https://chatgptplugins.directory/plugins/circleci.md): Build, test, and deploy any application
- [Cloudflare](https://chatgptplugins.directory/plugins/cloudflare.md): Cloudflare platform guidance with official MCP
- [Sentry](https://chatgptplugins.directory/plugins/sentry.md): Inspect recent Sentry issues and events

---
Source: https://chatgptplugins.directory/plugins/trailofbits-supply-chain-risk-auditor · Index: https://chatgptplugins.directory/llms.txt · Independent and community-run. Not affiliated with or endorsed by OpenAI. ChatGPT is a trademark of OpenAI.