Supply Chain Security

From the author

Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured collection of reference materials for evaluating software supply chain security. It includes industry-standard catalogs such as OpenSSF Scorecard, SLSA, Sigstore, and NTIA SBOM requirements. Beyond simple reference, it offers a framework for classifying security gaps by adoption effort, T-shirt sizing, and qualitative concern levels, enabling teams to translate audit findings into a prioritized backlog of actionable work items.

What it does

Provides reference catalogs for OpenSSF Scorecard, SLSA, Sigstore, and SBOM standards.
Maps repository posture against 27 combined supply chain capabilities.
Defines a taxonomy for classifying security gaps by implementation effort and risk.
Offers guidance on deriving work item priority from security risk levels.
Includes T-shirt sizing criteria for estimating remediation effort.
Provides a consolidated index of industry-standard security benchmarks.

When to use it

When performing a security audit of a software repository's supply chain.
When you need to map current repository practices against industry standards like SLSA or OpenSSF.
When you need to categorize security gaps to build a prioritized remediation backlog.
When you need to determine the effort required to implement specific security controls.

Advantages

Centralizes disparate security standards into a single, navigable reference set.
Standardizes the language used for gap analysis and risk assessment.
Facilitates objective prioritization of security tasks based on risk and effort.
Provides clear, actionable categories for implementing security improvements.

Usage examples

“How should I classify a gap in my repository's branch protection settings?”: The skill provides a classification for Platform Configuration, suggesting it is a standard setting change with specific effort sizing and concern level criteria.
“What is the priority for a high-risk Scorecard finding?”: The skill provides a mapping from risk levels to priority and execution order, helping you decide whether to address the finding immediately.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/supply-chain-security/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip supply-chain-security.zip -d .agents/skills

Documentation by Microsoft

This skill packages the durable software supply chain security (SSSC) reference material: open-standard catalogs, the combined capabilities inventory, and the classification taxonomies used to assess a repository's posture and turn gaps into prioritized work items.

When to use

Use this skill when you need to:

Assess a repository against the 27 combined supply chain capabilities from hve-core and physical-ai-toolchain.
Map posture against OpenSSF Scorecard, SLSA v1.2 (Build track unchanged since v1.0), OpenSSF Best Practices Badge, Sigstore (cosign), or NTIA SBOM minimum elements.
Classify a gap by adoption category, effort size, or qualitative concern level.
Derive work item priority and execution order from Scorecard risk levels.

Skill layout

Load the reference file for the topic you need. Each file holds the verbatim standard catalog or taxonomy.

Reference	Topic
references/00-index.md	Navigation catalog for every reference in this skill
references/openssf-scorecard.md	OpenSSF Scorecard 20 checks with risk levels and score ranges
references/slsa-levels.md	SLSA v1.2 Build track levels L0 through L3
references/best-practices-badge.md	OpenSSF Best Practices Badge Passing, Silver, and Gold criteria
references/sigstore-maturity.md	Sigstore (cosign) adoption maturity levels
references/sbom-elements.md	NTIA SBOM minimum elements and format guidance
references/capabilities-inventory.md	27 combined capabilities across hve-core, PAT, and shared sets
references/adoption-categories.md	Six adoption categories, effort sizing, and concern levels
references/scorecard-check-mapping.md	Full 20-check implementation and adoption reference mapping
references/priority-derivation.md	Risk level to priority and execution order derivation

Attribution

Standard catalogs in this skill derive from their respective upstream projects. Per-reference attribution appears at the bottom of each reference file. See references/00-index.md for the consolidated attribution summary.

Files

ATTRIBUTION.mdAdded by AutoGineer847 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.1 KiB
references/00-index.md3.0 KiB
references/adoption-categories.md3.7 KiB
references/best-practices-badge.md1.2 KiB
references/capabilities-inventory.md6.9 KiB
references/openssf-scorecard.md3.9 KiB
references/priority-derivation.md1.2 KiB
references/sbom-elements.md1015 B
references/scorecard-check-mapping.md5.2 KiB
references/sigstore-maturity.md720 B
references/slsa-levels.md1.3 KiB

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude Code
MITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k