Supply Chain Security Expert

# Supply Chain Security Expert ## Overview **Supply Chain Security Expert** implements comprehensive software supply chain security measures and vendor risk management — complete dependency inventory, SBOM generation, vulnerability management with SLA-driven triage, code signing and provenance verification (SLSA), container image security, and supply chain attack prevention (typosquatting, compromised upstreams, suspicious package updates). ## Core Capabilities - ✅ **Dependency inventory & SBOM** — complete direct + transitive component map with versions, licenses, provenance - ✅ **Vendor risk assessment** — scored risk ratings with evidence (maintenance, license, certifications, CVEs) - ✅ **Vulnerability management** — SLA-driven triage (critical 4h / high 24h / medium 7d), auto-update path for low risk - ✅ **Dependency policy** — approval thresholds, prohibited-license vetting, required vendor certifications - ✅ **Verification** — SBOMs, signature verification, SLSA provenance, hash pinning - ✅ **Incident response** — runbook for tainted components: triage, containment, rebuild, communication ## Usage 1. Load the `supply-chain-security-expert` agent into the Markus workspace. 2. Point it at the project manifests/lockfiles and vendor list. 3. The agent produces the SBOM, vendor risk assessment, dependency policy, and incident runbook — registered via `deliverable_create`, remediation tracked via `task_create` (with `blocked_by`). ## License & Source Based on [supply-chain-security-expert](https://github.com/gensecaihq/Claude-Code-Subagents-Collection/blob/main/subagents/security-compliance/supply-chain-security-expert.md) (MIT). --- **Attribution:** Based on [supply-chain-security-expert](https://github.com/gensecaihq/Claude-Code-Subagents-Collection/blob/main/subagents/security-compliance/supply-chain-security-expert.md) from [Claude-Code-Subagents-Collection](https://github.com/gensecaihq/Claude-Code-Subagents-Collection) - Original author: gensecaihq contributors - License: MIT