Supply Chain Checklist

---
name: supply-chain-checklist
description: Checklist for passive supply chain security assessment. Covers JavaScript library identification, known CVEs, SRI, source maps, and exposed dependency files.
allowed-tools: Read, Grep, Glob, WebSearch, Bash(curl:*), Bash(python:*), Bash(python3:*), Bash(grep:*), Bash(head:*), Bash(tail:*), Bash(echo:*), Bash(cat:*), Bash(jq:*), mcp__plugin_playwright_playwright__browser_navigate, mcp__plugin_playwright_playwright__browser_snapshot, mcp__plugin_playwright_playwright__browser_evaluate, mcp__plugin_playwright_playwright__browser_run_code, mcp__plugin_playwright_playwright__browser_close
---

## 1. JavaScript Library Identification

Methods to detect libraries and versions:

### From CDN URLs
Parse `<script src="...">` tags for version patterns:
- `jquery-3.6.0.min.js`, `react@18.2.0`, `vue@3.3.4`
- CDN URLs: `cdnjs.cloudflare.com`, `cdn.jsdelivr.net`, `unpkg.com`

### From Global Variables (Playwright)
```javascript
const libs = {};
// jQuery
if (window.jQuery) libs['jquery'] = window.jQuery.fn.jquery;
if (window.$?.fn?.jquery) libs['jquery'] = window.$.fn.jquery;
// React
if (window.React) libs['react'] = window.React.version;
if (window.__REACT_DEVTOOLS_GLOBAL_HOOK__) libs['react'] = 'detected (version from devtools hook)';
// Vue
if (window.Vue) libs['vue'] = window.Vue.version;
if (window.__VUE__) libs['vue'] = 'detected (v3)';
// Angular
if (window.angular) libs['angularjs'] = window.angular.version.full;
if (window.ng?.coreTokens) libs['angular'] = 'detected (v2+)';
// Bootstrap
if (window.bootstrap?.Tooltip?.VERSION) libs['bootstrap'] = window.bootstrap.Tooltip.VERSION;
// Lodash
if (window._?.VERSION) libs['lodash'] = window._.VERSION;
// Moment.js
if (window.moment?.version) libs['moment'] = window.moment.version;
// D3
if (window.d3?.version) libs['d3'] = window.d3.version;
// Three.js
if (window.THREE?.REVISION) libs['three'] = window.THREE.REVISION;
// Axios
if (window.axios?.VERSION) libs['axios'] = window.axios.VERSION;

JSON.stringify(libs, null, 2);
```

### From JS Comments/Banners
Check first few lines of JS files for version comments:
```javascript
const scripts = Array.from(document.querySelectorAll('script[src]')).map(s => s.src);
// For each external script, fetch and check first 5 lines for version banners
```

### From meta tags and HTML generators
```javascript
const generator = document.querySelector('meta[name="generator"]')?.content;
// e.g., "WordPress 6.4.2", "Drupal 10", "Next.js"
```

## 2. Known CVE Lookup

For each detected library+version, search for known vulnerabilities:
- Use WebSearch tool: `"<library> <version> CVE vulnerability"`
- Check specific databases:
  - Snyk: `https://security.snyk.io/package/npm/<package>`
  - NVD: search for library name in CVE database
  - GitHub Advisories: `https://github.com/advisories?query=<library>`

Classification:
- Library with known Critical CVE → Critical
- Library with known High CVE → High
- Library with known Medium CVE → Medium
- Outdated library (no known CVE) → Low

## 3. Subresource Integrity (SRI)

Check all external scripts and stylesheets for `integrity` attribute:

```javascript
// Playwright evaluate
const resources = Array.from(document.querySelectorAll('script[src], link[rel="stylesheet"][href]'));
const external = resources.filter(el => {
  const url = el.src || el.href;
  return url && (url.startsWith('http://') || url.startsWith('https://')) && !url.includes(window.location.hostname);
});
const noSRI = external.filter(el => !el.integrity).map(el => ({
  tag: el.tagName.toLowerCase(),
  url: el.src || el.href,
  hasCrossorigin: el.hasAttribute('crossorigin')
}));
JSON.stringify(noSRI, null, 2);
```

External scripts without SRI: Medium severity.
External scripts without SRI from HTTP (not HTTPS): High severity.

## 4. Source Map Exposure

For each JS file found on the page:

### Check sourceMappingURL comments
```javascript
// Playwright: get all script sources and check for sourceMappingURL
const scripts = Array.from(document.querySelectorAll('script[src]')).map(s => s.src);
// For each, the agent should fetch the JS file and check for:
// //# sourceMappingURL=<file>.map
// //@ sourceMappingURL=<file>.map
```

### Probe for .map files
```bash
# For each JS file URL found:
curl -sI "https://TARGET/path/to/bundle.js.map" -o /dev/null -w "%{http_code}"
curl -sI "https://TARGET/path/to/main.js.map" -o /dev/null -w "%{http_code}"
```

Source maps exposed: High severity (leaks original source code, comments, variable names).

## 5. Exposed Dependency Files

Probe for publicly accessible dependency manifests:
```bash
for file in /package.json /package-lock.json /yarn.lock /pnpm-lock.yaml /composer.json /composer.lock /Gemfile /Gemfile.lock /requirements.txt /Pipfile /Pipfile.lock /go.mod /go.sum /Cargo.toml /Cargo.lock /pom.xml /build.gradle /mix.exs; do
  code=$(curl -sI "https://TARGET${file}" -o /dev/null -w "%{http_code}")
  [ "$code" = "200" ] && echo "EXPOSED: $file"
done
```

If package.json is accessible, parse it for dependencies and versions:
```bash
curl -s "https://TARGET/package.json" | python3 -c "
import sys, json
try:
    pkg = json.load(sys.stdin)
    deps = {**pkg.get('dependencies', {}), **pkg.get('devDependencies', {})}
    for name, version in sorted(deps.items()):
        print(f'{name}: {version}')
except: pass
"
```

## 6. Outdated Framework Detection

Check meta generators and known version patterns:
- WordPress: `<meta name="generator" content="WordPress X.Y.Z">`
- Drupal: `<meta name="generator" content="Drupal X">`
- Joomla: `<meta name="generator" content="Joomla!">`
- Next.js: `__NEXT_DATA__` in page source
- Nuxt.js: `__NUXT__` in page source

For CMS detection, check:
```bash
# WordPress
curl -s https://TARGET/wp-includes/version.php 2>/dev/null | head -20
curl -s https://TARGET/readme.html 2>/dev/null | head -20

# Common version files
curl -s https://TARGET/CHANGELOG.md 2>/dev/null | head -5
curl -s https://TARGET/CHANGES.md 2>/dev/null | head -5
```

## Severity Assessment Guide

| Finding | Severity |
|---------|----------|
| Library with known Critical CVE | Critical |
| Library with known High CVE | High |
| Source maps exposed (leaking source) | High |
| package.json/lock exposed | Medium |
| Missing SRI on external CDN scripts | Medium |
| Outdated library (no known CVE) | Low |
| Exposed .map files without sensitive data | Medium |
| requirements.txt/Gemfile exposed | Medium |
| CMS with known version (no CVE) | Low |
| Generator meta tag present | Info |

## Finding Report Format

Each finding MUST follow this format:
```markdown
### [SEVERITY] Problem title
- **URL/Evidence:** specific URL, header, code fragment
- **Risk:** technical + business risk description
- **Recommendation:** what to do (with config/code example)
- **Verification:** how to confirm the fix
- **Owner:** Dev / DevOps / Security
```