skills.rest
Sokoliem
SokoliemCOMMUNITY
Explore all skills by this author →
GitHub

supply-chain-hardening

Audit software supply chains for lockfile integrity, install-script trust, and artifact provenance.

Updated Aug 23, 2026
Search Tags:#supply-chain#security-audit#sbom#lockfile#dependency-security#ci-pipeline#container-provenance
One-click install
npx skills add https://github.com/Sokoliem/ultraprompt --skill supply-chain-hardening
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-hardening
Source: https://github.com/Sokoliem/ultraprompt/tree/main/skills/supply-chain-hardening
Command: npx skills add https://github.com/Sokoliem/ultraprompt --skill supply-chain-hardening

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Supply chains are a frequent attack surface; this skill enforces and automates hardening across lockfiles, install scripts, CI publishing pipelines, SBOM generation, container image provenance, and registry trust to reduce vendor risk and ensure artifact integrity.

Core Features & Use Cases

  • Lockfile hygiene: enforce integrity and reproducible builds across projects.
  • Install-script review: detect and mitigate risky transitive install scripts.
  • CI publishing governance: gate artifact publishing with secure credentials and provenance.
  • SBOM generation & provenance: generate software bill of materials and trace artifact origins.
  • Container image provenance: pin digests and verify base images to prevent drift.
  • Registry trust & policy: enforce trusted registries and access controls.

Quick Start

Audit the current project's supply chain by reviewing lockfiles, install scripts, SBOM generation, container provenance, and registry trust.

Frequently Asked Questions about supply-chain-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my software supply chain for insecure publishing pipelines?▼

Software supply chain audits review lockfile integrity, install scripts, CI publishing governance, SBOM generation, and registry trust to reduce vendor risk and ensure artifact integrity.

What is the best way to enforce lockfile hygiene and reproducible builds?▼

Lockfile hygiene is enforced through explicit integrity checks that validate dependency versions to guarantee reproducible builds across projects.

How do I generate an SBOM and trace artifact provenance during CI?▼

SBOM generation and provenance tracing are automated within CI pipelines to map software bill of materials and verify artifact origins across builds and releases.

Why should I pin container image digests and verify base images?▼

Pinning container image digests prevents base image drift by verifying provenance and ensuring the exact trusted image is used across builds and releases.

Can I detect risky transitive install scripts in my dependencies?▼

Install-script validation detects and mitigates risky transitive install scripts by requiring explicit trust checks before execution during the supply chain audit.

How do I enforce trusted registries and access controls for artifact publishing?▼

Registry trust and policy enforcement gates artifact publishing with secure credentials, ensuring only trusted registries are used and access controls are maintained.

Related Skills

Explore More Software Engineering Skills→
amanhsnamanhsn

CI/CD Pipeline Builder

Detect repository stacks and generate CI pipeline templates for GitHub Actions and GitLab CI.

Community
Intermediate
williamzujkowskiwilliamzujkowski
6

Software Supply Chain Security Validator

Generate SBOMs, scan dependencies, and validate SLSA provenance attestations.

Community
Advanced
icartshicartsh
4

code-analyze

Analyze .NET solutions for code quality, security, and dependency issues.

Community
Advanced
vertivolatamvertivolatam
1

Container Security

Automate container security with image scanning, runtime monitoring, and image signing.

Official
Advanced