Supply Chain Security
MicrosoftOfficialPublished by Microsoft
- Skill
- Guidelines
- Security
- MIT
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
This skill provides a structured collection of reference materials for evaluating software supply chain security. It includes industry-standard catalogs such as OpenSSF Scorecard, SLSA, Sigstore, and NTIA SBOM requirements. Beyond simple reference, it offers a framework for classifying security gaps by adoption effort, T-shirt sizing, and qualitative concern levels, enabling teams to translate audit findings into a prioritized backlog of actionable work items.
What it does
- Provides reference catalogs for OpenSSF Scorecard, SLSA, Sigstore, and SBOM standards.
- Maps repository posture against 27 combined supply chain capabilities.
- Defines a taxonomy for classifying security gaps by implementation effort and risk.
- Offers guidance on deriving work item priority from security risk levels.
- Includes T-shirt sizing criteria for estimating remediation effort.
- Provides a consolidated index of industry-standard security benchmarks.
When to use it
- When performing a security audit of a software repository's supply chain.
- When you need to map current repository practices against industry standards like SLSA or OpenSSF.
- When you need to categorize security gaps to build a prioritized remediation backlog.
- When you need to determine the effort required to implement specific security controls.
Advantages
- Centralizes disparate security standards into a single, navigable reference set.
- Standardizes the language used for gap analysis and risk assessment.
- Facilitates objective prioritization of security tasks based on risk and effort.
- Provides clear, actionable categories for implementing security improvements.
Usage examples
- “How should I classify a gap in my repository's branch protection settings?”
- The skill provides a classification for Platform Configuration, suggesting it is a standard setting change with specific effort sizing and concern level criteria.
- “What is the priority for a high-risk Scorecard finding?”
- The skill provides a mapping from risk levels to priority and execution order, helping you decide whether to address the finding immediately.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/supply-chain-security/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip supply-chain-security.zip -d .agents/skills
Documentation by Microsoft
Supply Chain Security
This skill packages the durable software supply chain security (SSSC) reference material: open-standard catalogs, the combined capabilities inventory, and the classification taxonomies used to assess a repository's posture and turn gaps into prioritized work items.
When to use
Use this skill when you need to:
Assess a repository against the 27 combined supply chain capabilities from hve-core and physical-ai-toolchain.
Map posture against OpenSSF Scorecard, SLSA v1.2 (Build track unchanged since v1.0), OpenSSF Best Practices Badge, Sigstore (cosign), or NTIA SBOM minimum elements.
Classify a gap by adoption category, effort size, or qualitative concern level.
Derive work item priority and execution order from Scorecard risk levels.
Skill layout
Load the reference file for the topic you need. Each file holds the verbatim standard catalog or taxonomy.
| Reference | Topic |
|---|---|
| references/00-index.md | Navigation catalog for every reference in this skill |
| references/openssf-scorecard.md | OpenSSF Scorecard 20 checks with risk levels and score ranges |
| references/slsa-levels.md | SLSA v1.2 Build track levels L0 through L3 |
| references/best-practices-badge.md | OpenSSF Best Practices Badge Passing, Silver, and Gold criteria |
| references/sigstore-maturity.md | Sigstore (cosign) adoption maturity levels |
| references/sbom-elements.md | NTIA SBOM minimum elements and format guidance |
| references/capabilities-inventory.md | 27 combined capabilities across hve-core, PAT, and shared sets |
| references/adoption-categories.md | Six adoption categories, effort sizing, and concern levels |
| references/scorecard-check-mapping.md | Full 20-check implementation and adoption reference mapping |
| references/priority-derivation.md | Risk level to priority and execution order derivation |
Attribution
Standard catalogs in this skill derive from their respective upstream projects. Per-reference attribution appears at the bottom of each reference file. See references/00-index.md for the consolidated attribution summary.
Files
- ATTRIBUTION.mdAdded by AutoGineer847 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SKILL.md3.1 KiB
- references/00-index.md3.0 KiB
- references/adoption-categories.md3.7 KiB
- references/best-practices-badge.md1.2 KiB
- references/capabilities-inventory.md6.9 KiB
- references/openssf-scorecard.md3.9 KiB
- references/priority-derivation.md1.2 KiB
- references/sbom-elements.md1015 B
- references/scorecard-check-mapping.md5.2 KiB
- references/sigstore-maturity.md720 B
- references/slsa-levels.md1.3 KiB
references/capabilities-inventory.md
description: The 27 combined supply chain capabilities across hve-core unique, physical-ai-toolchain unique, and shared sets, with the detect/classify/document/verify assessment protocol
27 Combined Capabilities Inventory
Assess a target repository's supply chain security posture against the combined capabilities inventory from hve-core and physical-ai-toolchain.
Scope: This file defines the full set of 27 combined capabilities. They are a distinct taxonomy from the 20 OpenSSF Scorecard checks, which are a separate standard catalog with substantial conceptual overlap (the inventory treats the whole Scorecard scan as a single capability, #22). For the per-check crosswalk between the 20 Scorecard checks and these capabilities, see scorecard-check-mapping.md. The inventory also draws on capabilities sourced from SLSA build levels, the OpenSSF Best Practices Badge, Sigstore (cosign), and NTIA SBOM minimum elements — see their respective reference files for those standards.
hve-core Unique (6)
| # | Capability | Implementation |
|---|---|---|
| 1 | pip-audit | pip-audit.yml reusable workflow for Python dependency vulnerability scanning |
| 2 | Action version consistency | Test-ActionVersionConsistency.ps1 validates all workflow references use consistent versions |
| 3 | Automated SHA pinning updates | Update-ActionSHAPinning.ps1 automates SHA pin refresh when actions publish new versions |
| 4 | Consolidated weekly security summary | Aggregated reporting across all security scan results |
| 5 | Get-VerifiedDownload.ps1 | Verified download utility with SHA-256 hash validation for external tool acquisition |
| 6 | Security workflow orchestration | Coordinated execution of multiple security scans with unified reporting |
Critical incident prompt: Recall the most recent near-miss or incident in this repository involving an unpinned or stale GitHub Action, an unverified external tool download, or a Python dependency CVE — which of the controls in this batch would have detected or prevented it, and which gap let it through?
physical-ai-toolchain Unique (10)
| # | Capability | Implementation |
|---|---|---|
| 7 | SBOM generation | anchore/sbom-action producing SPDX-JSON output per release |
| 8 | Sigstore signing | gitsign-based keyless signing for release tags and commits |
| 9 | DAST/ZAP | Dynamic application security testing via OWASP ZAP |
| 10 | Dual attestation | Build provenance and SBOM attestation via actions/attest-build-provenance and actions/attest |
| 11 | Stale docs → issue | Automated issue creation when documentation drifts from code |
| 12 | OpenSSF Best Practices badge | Badge enrollment and criteria tracking in GOVERNANCE.md |
| 13 | Dependabot security prefix enrichment | Auto-retitle security Dependabot PRs with security(deps): prefix using GHSA/CVSS metadata |
| 14 | Comprehensive threat model | Structured threat model document with STRIDE analysis |
| 15 | release-please pipeline | Automated release management with conventional commits |
| 16 | Vulnerability SLA | Defined service-level agreements for vulnerability remediation timelines |
Critical incident prompt: Describe the most recent time a downstream consumer, auditor, or release reviewer questioned a release's provenance, signature, SBOM contents, threat model coverage, or vulnerability-remediation timeline — which of the controls in this batch would have provided sufficient evidence or shortened the response?
Shared (11)
| # | Capability | Implementation |
|---|---|---|
| 17 | Dependency pinning | dependency-pinning-scan.yml with Test-DependencyPinning.ps1 |
| 18 | SHA staleness | SHA staleness checks validating pinned action references are current |
| 19 | gitleaks | Secret scanning via gitleaks in CI pipelines |
| 20 | CodeQL | GitHub Code Scanning with CodeQL for SAST |
| 21 | Dependency review | dependency-review.yml for PR-time dependency change analysis |
| 22 | OpenSSF Scorecard | Scorecard scanning for supply chain security posture |
| 23 | Workflow permissions | Test-WorkflowPermissions.ps1 enforcing least-privilege token permissions |
| 24 | Copyright headers | Automated copyright header validation across source files |
| 25 | Dependabot | Dependabot configuration for automated dependency updates |
| 26 | SECURITY.md | Security policy document with vulnerability reporting process |
| 27 | CODEOWNERS | Code ownership enforcement for required reviews |
Critical incident prompt: Recall the most recent leaked secret, unreviewed dependency change, over-privileged workflow token, CodeQL finding, or unpatched CVE that affected this repository — which of the controls in this batch caught it, would have caught it, or shortened the time to remediate?
Assessment Protocol
For each of the 27 capabilities, evaluate the target repository:
Detect: Search the repository for evidence of the capability (workflow files, scripts, configuration, documentation).
Classify: Assign a coverage status:
✅ Covered — capability is implemented and active
⚠️ Partial — capability exists but is incomplete or misconfigured
❌ Gap — capability is absent
➖ N/A — capability does not apply to this repository's technology stack
Document: Record evidence (file paths, workflow names, configuration details) for each assessment.
Verify: For ✅ and ⚠️ items, confirm the implementation matches the reference patterns from hve-core or physical-ai-toolchain.
Requirements and compatibility
Written for: GitHub Copilot, Claude Code
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Claude Code frontmatter
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/hve-core · .github/skills/security/supply-chain-security · commit f425e94
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Microsoft.
Related skills
Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude CodeMITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download supply-chain-security.zip