skills.rest
miethe
mietheCOMMUNITY
Explore all skills by this author →
Website𝕏@MietheGitHub

asdlc-skillbom-builder

Generate and verify SkillBOM provenance records with Ed25519 signing.

Updated May 3, 2026
Search Tags:#provenance#git integration#supply chain#attestation#artifact governance#skillbom#ed25519 signing
One-click install
npx skills add https://github.com/miethe/boxbrain-2 --skill asdlc-skillbom-builder
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: asdlc-skillbom-builder
Source: https://github.com/miethe/boxbrain-2/tree/main/.claude/skills/asdlc-skillbom-builder
Command: npx skills add https://github.com/miethe/boxbrain-2 --skill asdlc-skillbom-builder

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps teams create trustworthy provenance records for skills, agents, commands, and other SkillMeat artifacts without confusing evidence generation with packaging, approval, or deployment.

Core Features & Use Cases

  • BOM Generation and Verification: Create project-level SkillBOM snapshots, calculate content hashes, sign them with Ed25519, and verify their integrity.
  • Deployment Provenance: Inspect materialization sidecars for parameterized deployments and connect BOM snapshots to Git commits.
  • Attestations and Governance: Create, list, and inspect owner-scoped attestations while accounting for visibility rules, local policy limitations, and non-persisted notes or signatures.
  • Use Case: When preparing a reviewed skill for distribution, generate its provenance snapshot, verify or sign the evidence, record an attestation, and hand the resulting BOM path or attestation ID to the packaging workflow.

Quick Start

Use the asdlc-skillbom-builder skill to generate and verify a SkillBOM snapshot for the current project, then report its hash, signature status, and any attestation identifier.

Frequently Asked Questions about asdlc-skillbom-builder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a provenance record for a skill deployment?▼

Generate a SkillBOM provenance record by creating a project-level snapshot, calculating its content hash, and signing it with Ed25519 to verify artifact integrity. You can then inspect materialization sidecars and connect the snapshot to Git commits.

What is artifact provenance and when do I need a SkillBOM snapshot?▼

Artifact provenance tracks the origin and integrity of skills, agents, and commands. You need a SkillBOM snapshot when preparing a reviewed skill for distribution to generate trustworthy evidence and verify its integrity before handoff.

Can I use Ed25519 signing to verify artifact governance attestations?▼

Yes, you can sign SkillBOM snapshots with Ed25519 and create owner-scoped attestations. The workflow supports listing and inspecting these attestations while accounting for visibility rules and local policy limitations.

Does Git integration work with supply chain provenance tracking?▼

Git integration links BOM snapshots directly to specific commits for supply chain provenance tracking. This connects deployment sidecars to repository state, ensuring artifact governance remains verifiable across project snapshots.

What are the limitations of local policy enforcement for artifact attestations?▼

Local policy enforcement limitations prevent certain attestations from persisting notes or signatures permanently. The workflow distinguishes local constraints from enterprise policy enforcement and avoids claiming approval or inventing unsupported provenance formats.

Related Skills

Explore More Legal & Compliance Skills→
fxckcodefxckcode

git-setup-skill

Automate Git/GitHub repository setup with baseline governance files and CI workflows.

Community
Advanced
amdamd
154

quark-workspace-validate

Validate workspace paths, model references, and output directories before Quark workflows.

Official
Intermediate
viinearaujoviinearaujo
1

uipath-governance

Author AOps product feature rules and Access ToolUsePolicy resource boundaries via UiPath CLI.

Community
Advanced
patricio0312revpatricio0312rev
5

artifact-sbom-publisher

Generate SBOMs and publish artifacts with provenance metadata in CI/CD pipelines.

Community
Advanced