skills.rest
chainloop-devchainloop-devOfficial·5 Agent Skills Included

chainloop

Secure software supply chains with attestations, SBOMs, and policy checks

Collects and stores signed attestations, SBOMs, VEX, and SARIF reports from any CI/CD pipeline in one evidence store. Enforces workflow contracts and Rego policies so security teams control what evidence is required without burdening developers. Includes AI skills that automate vulnerability remediation, Dependabot PR triage, and Go or Helm chart upgrades.
583|54
↗
npx skills add chainloop-dev/chainloop --all -g -y
Available:

Gives the AI agent a full map of the Chainloop architecture, build and test commands, and development conventions so it can work on the control plane, CLI, and storage services correctly.

All Skills in This Repository (5)

Pure Emerald Level Indicators
📦 In Repo
chainloop-devchainloop-dev

vulnerability-remediation

Reviews Chainloop vulnerability policy violations and fixes CVEs in Dockerfiles and go.mod.

Official
Advanced
📦 In Repo
chainloop-devchainloop-dev

dependabot-pr-automation

Reviews, risk-assesses, approves, and merges open Dependabot pull requests on GitHub.

Official
Intermediate
📦 In Repo
chainloop-devchainloop-dev

custom-builtin-functions

Create custom Go built-in functions for OPA/Rego policy evaluation.

Official
Advanced
📦 In Repo
chainloop-devchainloop-dev

upgrading-chart

Automate Helm chart dependency upgrades for PostgreSQL and Vault.

Official
Advanced
📦 In Repo
chainloop-devchainloop-dev

upgrading-golang

Automates Go version upgrades across Chainloop source, Dockerfiles, CI workflows and documentation with SHA256 digests and optional Atlas migrations updates.

Official
Advanced

Frequently Asked Questions

FAQPage Schema
How to install Chainloop skills?▼

Run `npx skills add chainloop-dev/chainloop --all -g -y` in your terminal to install all skills in this suite globally.

What is Chainloop used for?▼

Chainloop is an open-source evidence store for software supply chain security. It collects signed attestations, SBOMs, and scan reports from your CI/CD pipelines and checks them against policies.

Can AI fix vulnerabilities in my project automatically?▼

Yes. The vulnerability-remediation skill reads failing policy results from Chainloop, finds the affected Dockerfile or Go module, applies the fix, and opens a pull request.

How to auto-merge Dependabot PRs safely?▼

The dependabot-pr-automation skill checks each PR's version bump type and CI status, then approves and merges only low-risk patch and minor updates.

Does Chainloop work with GitHub Actions and GitLab?▼

Yes. Chainloop integrates with GitHub Actions, GitLab, Azure DevOps, Jenkins, and other CI/CD platforms through a single CLI-based attestation step.

Related Repositories in Software Engineering

View All in Software Engineering→
openclawopenclaw
388.4k

openclaw

Run a personal AI assistant across your devices and chat apps

Official📦 120 Skills
obraobra
280.0k

superpowers

Gives coding agents a disciplined workflow from idea to merged code

Community📦 15 Skills
facebookfacebook
248.4k

react

AI agent skills for building, testing, and porting React core

Official📦 14 Skills