Automate OpenSSF Scorecard GitHub Action installation and remediation.
npx skills add https://github.com/zcaceres/skills --skill security-openssf
Please help me install this Agent Skill. Skill: security-openssf Source: https://github.com/zcaceres/skills/tree/main/skills/security-openssf Command: npx skills add https://github.com/zcaceres/skills --skill security-openssf
This skill solves the problem of insecure or poorly configured supply-chain security by automating the setup of the OpenSSF Scorecard GitHub Action with a safe, two-phase rollout that prevents premature public exposure of low security scores.
Run the security-openssf skill to scaffold the OpenSSF Scorecard action in your repository.
High-intent search queries and answers about installing and using this skill.
Automate OpenSSF Scorecard setup using a safe, two-phase rollout that initially publishes results privately (publish_results: false). This allows for internal triage and remediation of security findings before opting into public scorecard.dev dashboard reporting.
Generate a remediation plan from OpenSSF Scorecard SARIF reports by running the fix subcommand. It analyzes the SARIF findings and generates a bucketed plan to address both file-based and settings-based supply-chain security issues in the repository.
Yes, you need both the GitHub CLI (gh) and jq to automate OpenSSF supply-chain security workflows. These dependencies are required for processing SARIF report artifacts and managing target repository settings and workflow configurations.
The best way to roll out OpenSSF Scorecard GitHub Actions is a two-phase approach: install the action in a private-first mode for internal triage, remediate file and settings issues, then enable public reporting to safely improve supply-chain security posture.
Yes, you can automatically manage repository security policy enforcement and workflow configuration for OpenSSF Scorecard. The automation targets public repositories to configure workflows, analyze SARIF reports, and enforce security settings.
The security-openssf automation uses a private-first mode to prevent premature public exposure of low security scores. It allows developers to identify and fix supply-chain vulnerabilities privately before opting into the public scorecard.dev reporting.
bjcoombsGenerates a read-only GitHub repository status report with CI and security data.
zcaceresScaffold OpenSSF Scorecard GitHub Actions with a two-phase rollout.
brittaniebuffiecsuRecover deleted commits and detect supply chain attacks in GitHub repositories.
SkobynAnalyze public GitHub repos, Docker images, and package configs for supply-chain vulnerabilities.
