openssf

Scaffold OpenSSF Scorecard GitHub Actions with a two-phase rollout.

7|Updated May 28, 2026

Search Tags:#security #supply-chain #github-actions #hardening #openssf #scorecard

Ready to run

npx skills add https://github.com/zcaceres/skills --skill openssf

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: openssf
Source: https://github.com/zcaceres/skills/tree/main/plugins/security/skills/openssf
Command: npx skills add https://github.com/zcaceres/skills --skill openssf

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jq, gh, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill automates the complex setup and remediation of OpenSSF Scorecard, preventing poor security scores from appearing on public dashboards while providing a clear path to hardening your supply chain.

Core Features & Use Cases

Safe Two-Phase Rollout: Installs Scorecard in a private trial mode to triage findings before going public.
Automated Remediation: Generates a bucketed remediation plan for failing checks and applies file-based fixes.
Use Case: Use this when you need to add security boilerplate to a new public repository or when you need to fix specific supply-chain findings like Token-Permissions or Pinned-Dependencies.

Quick Start

Invoke the security openssf skill to install the scorecard workflow and begin the two-phase security rollout.

Frequently Asked Questions about openssf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate OpenSSF Scorecard setup for GitHub Actions?▼

You can automate OpenSSF Scorecard setup by scaffolding and managing GitHub Actions workflows, which installs the scorecard in a private trial mode to triage findings before going public.

What is the best way to fix supply-chain security findings like token permissions and pinned dependencies?▼

Fixing supply-chain security findings involves generating a bucketed remediation plan for failing checks and applying automated file-based fixes for specific issues like token permissions and pinned dependencies.

How does a two-phase rollout prevent poor security scores on public dashboards?▼

A two-phase rollout prevents poor security scores by first installing Scorecard in a private trial mode to triage and remediate findings before integrating with a public dashboard.

Do I need jq and gh installed to scaffold OpenSSF Scorecard workflows?▼

Yes, you need jq and gh installed as dependencies to scaffold the OpenSSF Scorecard workflows and apply configuration fixes for supply-chain hardening.

Can I apply configuration fixes automatically for OpenSSF Scorecard failing checks?▼

Yes, you can apply configuration fixes automatically because the process generates a bucketed remediation plan and directly applies file-based fixes for common supply-chain security findings.

When should I use a private trial mode for OpenSSF Scorecard?▼

You should use a private trial mode when adding security boilerplate to a new public repository, allowing you to triage findings and harden your supply chain before public exposure.