---
name: security:supply-check
description: Re-audit installed dependencies — check lockfiles against blocklists, OSV.dev CVEs, and typosquat detection
allowed-tools: Read, Bash
model: sonnet
---

# /security supply-check [path]

Re-audit installed dependencies in lockfiles (package-lock.json, yarn.lock, requirements.txt, Pipfile.lock) against blocklists, OSV.dev CVE database, and typosquat detection.

Unlike `deep-scan` (which includes dep-auditor among 9 scanners), this command runs ONLY the supply-chain-recheck scanner for a focused dependency audit.

## Step 1: Setup

- `$ARGUMENTS` empty → target = cwd. Otherwise target = first argument.
- Plugin root = parent of this `commands/` folder.

## Step 2: Run Scanner

```bash
node <plugin-root>/scanners/supply-chain-recheck-cli.mjs "<target>"
```

**Important:** This scanner calls OSV.dev API. If offline, blocklist and typosquat checks still run but CVE detection is skipped (an INFO finding notes this).

The scanner outputs JSON to stdout. Parse it.

## Step 3: Present Results

Show a summary banner:

```
## Supply Chain Re-check: [target]
Status: [ok|skipped|error] | Findings: XC XH XM XL XI | Files: N lockfile(s)
```

If `osv_offline: true` in result, note: "OSV.dev was unreachable — CVE check was skipped. Blocklist and typosquat checks completed."

## Step 4: Detail Findings

For each finding, show:
- Severity badge and title
- File (lockfile) and evidence
- Recommendation

Group by severity (CRITICAL first). If zero findings: "No supply chain issues detected in N lockfile(s)."

## Step 5: HTML Report

After producing the markdown supply-check report above:

1. Compute a temp markdown path:
   ```bash
   node -p "require('path').join(require('os').tmpdir(), 'sec-supply-check-' + Date.now() + '.md')"
   ```
2. Use the Write tool to save the **entire markdown report you just produced** (banner + lockfile coverage + all findings grouped by severity) to that temp path. Verbatim.
3. Run the renderer:
   ```bash
   node <plugin-root>/scripts/render-report.mjs supply-check --in "<temp-md-path>"
   ```
   The CLI writes `reports/supply-check-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
4. Append to your response (markdown link, no bare URL):

   > **HTML report:** [Open in browser](file:///abs/path.html)

If the CLI exits non-zero, mention the error but do not block — the markdown report above is the primary deliverable.
