skills.rest
williamzujkowski
williamzujkowskiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

Software Supply Chain Security Validator

Generate SBOMs, scan dependencies, and validate SLSA provenance attestations.

6|Updated Oct 25, 2025
Search Tags:#provenance#slsa#supply-chain-security#sbom#cosign#vulnerability-scanning#cyclonedx
One-click install
npx skills add https://github.com/williamzujkowski/cognitive-toolworks --skill software-supply-chain-security-validator
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Software Supply Chain Security Validator
Source: https://github.com/williamzujkowski/cognitive-toolworks/tree/main/skills/security-supplychain-validator
Command: npx skills add https://github.com/williamzujkowski/cognitive-toolworks --skill software-supply-chain-security-validator

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Software supply chains often suffer from opaque provenance, unverified dependencies, and insecure artifacts. This Skill provides end-to-end validation by generating SBOMs, scanning dependencies for known vulnerabilities, and validating SLSA provenance and attestations to reduce risk.

Core Features & Use Cases

  • Generate SPDX and CycloneDX SBOMs for container images, binaries, and source packages.
  • Validate dependency provenance and build attestations against EO 14028 requirements.
  • Produce risk scores and actionable remediation guidance for procurement and deployment.

Quick Start

Run the validator on a sample artifact to generate an SBOM, provenance report, and risk assessment.

Frequently Asked Questions about Software Supply Chain Security Validator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an SBOM for container images and source packages?▼

You can generate SPDX and CycloneDX SBOMs for container images, binaries, and source packages to quantify software supply chain risks and produce compliance-ready reports.

How does SLSA provenance validation work for software artifacts?▼

SLSA provenance validation works by verifying build attestations and dependency provenance against EO 14028 requirements, enforcing signature verification to reduce supply chain risks.

Can I scan dependencies for vulnerabilities across CI environments?▼

Yes, you can scan dependencies for known vulnerabilities across development and CI environments to identify risks in source code, container images, binaries, and packages.

What is the best way to verify software supply chain security attestations?▼

The best way to verify software supply chain security is by validating provenance attestations using Cosign signature verification and generating risk scores with actionable remediation guidance.

Does this supply chain validator support CycloneDX and SPDX formats?▼

Yes, this validator supports both CycloneDX and SPDX SBOM formats, producing JSON and human-readable outputs with risk scoring for procurement and deployment decisions.

What limitations exist when validating provenance for different artifact types?▼

Validation applies to source code, container images, binaries, and packages, but requires proper provenance attestations and signatures to generate accurate risk assessments and compliance reports.

Related Skills

Explore More Software Engineering Skills→
jg-chalk-iojg-chalk-io

moai-artifacts-builder

Automate artifact governance and lifecycle management with SBOM generation and compliance checks.

Community
Advanced
Scheune10-codingScheune10-coding

dependency-auditor

Scan dependencies for vulnerabilities, license compliance, and upgrade risks.

Community
Advanced
harnessharness
80

manage-supply-chain

Automates Harness SSCA configuration to generate SBOMs, sign artifacts with Cosign, and enforce OPA policies.

Official
Advanced
brucesongsbrucesongs
60

supply-chain-security

Audit dependencies, generate SBOMs, and harden CI/CD pipelines.

Community
Advanced