supply-chain-guard

Securing a repository against malware and leaks involves implementing package manager cooldowns, disabling bot auto-merge, SHA-pinning GitHub Actions, and scanning for leaks with Gitleaks and TruffleHog. This Skill automates these configurations for robust onboarding security.

Generating a CycloneDX SBOM using cdxgen provides a comprehensive inventory of repository dependencies. This Software Bill of Materials allows you to quickly identify and assess potential security vulnerabilities across your codebase.

Yes, you can integrate both Gitleaks and TruffleHog for pre-commit and continuous integration leak detection. Running both tools provides layered scanning to prevent sensitive data leaks before repository commits are finalized.

Preventing malicious dependency updates requires SHA-pinning GitHub Actions and applying cooldowns across package managers. Disabling bot auto-merge further ensures that automated dependency changes undergo human security review.

No external dependencies are required to run this repository security scan. The Skill includes internal scripts and references to execute security configurations, leak scanning, and SBOM generation directly within your environment.

Package manager cooldowns delay automated dependency updates to prevent malware injection, but they do not block manual updates. You should combine cooldowns with SHA-pinning and leak scanning for comprehensive repository maintenance sweeps.