Supply Chain Security

From the author

Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured collection of reference materials for evaluating software supply chain security. It includes industry-standard catalogs such as OpenSSF Scorecard, SLSA, Sigstore, and NTIA SBOM requirements. Beyond simple reference, it offers a framework for classifying security gaps by adoption effort, T-shirt sizing, and qualitative concern levels, enabling teams to translate audit findings into a prioritized backlog of actionable work items.

What it does

Provides reference catalogs for OpenSSF Scorecard, SLSA, Sigstore, and SBOM standards.
Maps repository posture against 27 combined supply chain capabilities.
Defines a taxonomy for classifying security gaps by implementation effort and risk.
Offers guidance on deriving work item priority from security risk levels.
Includes T-shirt sizing criteria for estimating remediation effort.
Provides a consolidated index of industry-standard security benchmarks.

When to use it

When performing a security audit of a software repository's supply chain.
When you need to map current repository practices against industry standards like SLSA or OpenSSF.
When you need to categorize security gaps to build a prioritized remediation backlog.
When you need to determine the effort required to implement specific security controls.

Advantages

Centralizes disparate security standards into a single, navigable reference set.
Standardizes the language used for gap analysis and risk assessment.
Facilitates objective prioritization of security tasks based on risk and effort.
Provides clear, actionable categories for implementing security improvements.

Usage examples

“How should I classify a gap in my repository's branch protection settings?”: The skill provides a classification for Platform Configuration, suggesting it is a standard setting change with specific effort sizing and concern level criteria.
“What is the priority for a high-risk Scorecard finding?”: The skill provides a mapping from risk levels to priority and execution order, helping you decide whether to address the finding immediately.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/supply-chain-security/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip supply-chain-security.zip -d .agents/skills

Documentation by Microsoft

This skill packages the durable software supply chain security (SSSC) reference material: open-standard catalogs, the combined capabilities inventory, and the classification taxonomies used to assess a repository's posture and turn gaps into prioritized work items.

When to use

Use this skill when you need to:

Assess a repository against the 27 combined supply chain capabilities from hve-core and physical-ai-toolchain.
Map posture against OpenSSF Scorecard, SLSA v1.2 (Build track unchanged since v1.0), OpenSSF Best Practices Badge, Sigstore (cosign), or NTIA SBOM minimum elements.
Classify a gap by adoption category, effort size, or qualitative concern level.
Derive work item priority and execution order from Scorecard risk levels.

Skill layout

Load the reference file for the topic you need. Each file holds the verbatim standard catalog or taxonomy.

Reference	Topic
references/00-index.md	Navigation catalog for every reference in this skill
references/openssf-scorecard.md	OpenSSF Scorecard 20 checks with risk levels and score ranges
references/slsa-levels.md	SLSA v1.2 Build track levels L0 through L3
references/best-practices-badge.md	OpenSSF Best Practices Badge Passing, Silver, and Gold criteria
references/sigstore-maturity.md	Sigstore (cosign) adoption maturity levels
references/sbom-elements.md	NTIA SBOM minimum elements and format guidance
references/capabilities-inventory.md	27 combined capabilities across hve-core, PAT, and shared sets
references/adoption-categories.md	Six adoption categories, effort sizing, and concern levels
references/scorecard-check-mapping.md	Full 20-check implementation and adoption reference mapping
references/priority-derivation.md	Risk level to priority and execution order derivation

Attribution

Standard catalogs in this skill derive from their respective upstream projects. Per-reference attribution appears at the bottom of each reference file. See references/00-index.md for the consolidated attribution summary.

Files

ATTRIBUTION.mdAdded by AutoGineer847 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.1 KiB
references/00-index.md3.0 KiB
references/adoption-categories.md3.7 KiB
references/best-practices-badge.md1.2 KiB
references/capabilities-inventory.md6.9 KiB
references/openssf-scorecard.md3.9 KiB
references/priority-derivation.md1.2 KiB
references/sbom-elements.md1015 B
references/scorecard-check-mapping.md5.2 KiB
references/sigstore-maturity.md720 B
references/slsa-levels.md1.3 KiB

references/adoption-categories.md

description: Six supply chain adoption categories, T-shirt effort sizing, and qualitative concern levels for gap classification

Adoption Categories, Effort Sizing, and Concern Levels

Classify each supply chain gap by adoption category, effort size, and qualitative concern level.

Six Adoption Categories

Classify each gap into one of six adoption categories based on the required implementation effort:

1. Reusable Workflow Adoption

Reference an hve-core workflow directly via uses: in the target repository. Lowest effort — the target repo adds a workflow file that calls the reusable workflow.

Applicable checks: CI-Tests (#3), SAST (#14), Vulnerabilities (#19), and other checks where hve-core provides a reusable workflow_call workflow.

2. Workflow Copy/Modify

Copy a workflow from physical-ai-toolchain (or hve-core) and adapt it to the target repository's technology stack. Medium effort — requires editing workflow configuration.

Applicable checks: Dependency-Update-Tool (#8), SBOM (#15), Signed-Releases (#17), and other checks requiring repository-specific tuning.

3. Reusable Workflow + Script Adoption

Adopt both a reusable workflow and its supporting PowerShell or Python scripts. Medium effort — requires both workflow reference and script installation.

Applicable checks: Pinned-Dependencies (#13), Token-Permissions (#18), and other checks with validation scripts.

4. Platform Configuration

GitHub or Azure DevOps settings configured via the web UI or API. Variable effort — depends on organizational policies and admin access.

Applicable checks: Binary-Artifacts (#1), Branch-Protection (#2), Code-Review (#5), CII-Best-Practices (#4), License (#10), Security-Policy (#16), Webhooks (#20).

5. New Capability

Requires building something not available in either hve-core or physical-ai-toolchain. Highest effort.

Applicable checks: Fuzzing (#9) — requires setting up ClusterFuzzLite, OSS-Fuzz, or a custom fuzzing harness.

6. N/A / Organic

Not actionable as backlog items. These checks improve through natural project activity.

Applicable checks: Contributors (#6), Maintained (#11), Packaging (#12).

Effort Sizing

Assign T-shirt sizes based on implementation scope:

Size	Criteria	Typical Duration
S	Single file addition or configuration change	< 1 day
M	Multiple files or workflow customization required	1–3 days
L	Cross-cutting changes across CI/CD pipeline	3–5 days
XL	New capability build or major architectural change	1+ weeks

Qualitative Concern Levels

Assign a qualitative concern level to each gap reflecting residual risk after considering the repository's current posture and compensating controls. Concern is independent from Scorecard risk classification and from effort sizing.

Concern	Criteria
Low	Gap is informational or already partially mitigated by existing controls; minimal residual exposure
Moderate	Gap leaves measurable residual exposure but compensating controls reduce immediate impact
High	Gap leaves significant residual exposure with no effective compensating controls; prioritize remediation

Record concern in the gap table alongside Risk and Effort. Use Concern to break ties when multiple gaps share the same Scorecard risk classification.

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude Code
MITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download supply-chain-security.zip