skills.rest
rysweet
rysweetCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

supply-chain-audit

Audit CI/CD pipelines, container images, and dependency graphs for supply chain weaknesses.

8|4|Updated Mar 9, 2026
Search Tags:#security#dependencies#audit#supply-chain#ci-cd#slsa#sbom
One-click install
npx skills add https://github.com/rysweet/amplihack-rs --skill supply-chain-audit-rysweet
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-audit
Source: https://github.com/rysweet/amplihack-rs/tree/main/amplifier-bundle/skills/supply-chain-audit
Command: npx skills add https://github.com/rysweet/amplihack-rs --skill supply-chain-audit-rysweet

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Auditing software supply chain security across CI/CD pipelines, container images, and language ecosystems to identify mutable references, weak SBOM and SLSA readiness, and credential hygiene gaps.

Core Features & Use Cases

  • Detects mutable action pins, missing SBOMs, and improper credential handling.
  • Evaluates container image provenance, SBOM generation, and dependency integrity across languages.
  • Use Case: Pre-merge gate to block PRs that introduce supply chain regressions and to map SBOM coverage for compliance.

Quick Start

Run a complete supply chain audit on your repository to surface actionable findings and remediation steps.

Frequently Asked Questions about supply-chain-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my GitHub Actions workflows for mutable references and credential hygiene?▼

Auditing GitHub Actions workflows involves detecting mutable action pins, missing SBOMs, and improper credential handling. This Skill identifies mutable action pins and credential hygiene gaps across CI/CD pipelines to surface actionable supply chain findings.

How do I generate an SBOM and check SLSA readiness for my container images?▼

Checking SBOM generation and SLSA readiness evaluates container image provenance and dependency integrity. This Skill assesses your container images to map SBOM coverage and verify SLSA compliance for software supply chain security.

Can I use this supply chain audit for Python, Node.js, Go, Rust, and .NET ecosystems?▼

Yes, supply chain audits are applicable to Python, Node.js, Go, Rust, and .NET ecosystems. This Skill evaluates dependency graphs and language ecosystems to detect mutable references and verify dependency integrity.

How do I block pull requests that introduce supply chain security regressions?▼

Blocking pull requests requires auditing CI/CD pipelines to detect mutable references and weak SBOM readiness. This Skill serves as a pre-merge gate to identify and remediate software supply chain weaknesses before merging.

What is software supply chain security auditing and when do I need it?▼

Software supply chain security auditing identifies mutable references, weak SBOM and SLSA readiness, and credential hygiene gaps. You need it to evaluate CI/CD pipelines, container images, and dependency graphs for security and compliance.

Does this supply chain audit check dependency integrity across multiple language ecosystems?▼

Yes, this supply chain audit evaluates dependency integrity across Python, Node.js, Go, Rust, and .NET. It identifies mutable references and maps SBOM coverage to ensure secure artifact handling and compliance across languages.

Related Skills

Explore More Software Engineering Skills→
mrkhachaturovmrkhachaturov

cso

Audit dependencies, CI/CD configurations, and webhooks to generate a security posture report.

Community
Advanced
brucebanner010198-commitsbrucebanner010198-commits

sbom-slsa

Generates CycloneDX SBOMs and SLSA provenance for released artifacts.

Community
Advanced
penghang1223penghang1223
1

docker-security

Audit Docker containers for secure build, runtime, and supply-chain integrity.

Community
Advanced
robit-manrobit-man

supply-chain-forensics

Analyze dependency integrity, build pipelines, and SBOM composition for supply chain security.

Community
Advanced