skills.rest
asalhamed
asalhamedCOMMUNITY
Explore all skills by this author →
GitHub

supply-chain-security-agent

Generate SBOMs, sign artifacts, and record provenance for software and firmware releases.

Updated Apr 4, 2026
Search Tags:#provenance#supply-chain#spdx#slsa#signing#sbom#cyclonedx
One-click install
npx skills add https://github.com/asalhamed/dev-agents --skill supply-chain-security-agent
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-security-agent
Source: https://github.com/asalhamed/dev-agents/tree/main/supply-chain-security-agent
Command: npx skills add https://github.com/asalhamed/dev-agents --skill supply-chain-security-agent

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Coordinates and enforces end-to-end supply-chain security for software and firmware by producing SBOMs, signing artifacts, and recording provenance, enabling auditable releases for enterprise customers.

Core Features & Use Cases

  • SBOM generation (CycloneDX, SPDX) for containers, language packages, and firmware
  • Artifact signing (Sigstore / cosign) and provenance (in-toto / SLSA) for release integrity
  • Deterministic, reproducible builds with dependency vetting and tamper-evident release evidence
  • Use case: generate auditable release packages and accompanying provenance attestations for regulatory compliance

Quick Start

Configure the agent to generate an SBOM, sign the release, and attach provenance attestations to the first artifact.

Frequently Asked Questions about supply-chain-security-agent

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an SBOM and provenance attestations for release artifacts?▼

To generate an SBOM and provenance attestations for release artifacts, you can automate the workflow to produce CycloneDX or SPDX reports and attach in-toto/SLSA evidence for auditable release integrity.

What is the best way to automate supply-chain security for containers and language packages?▼

Automating supply-chain security for containers and language packages involves enforcing deterministic builds, strict artifact signing with cosign, and dependency vetting across npm, PyPI, Cargo, Maven, and Go modules.

Does this approach support both SPDX and CycloneDX SBOM formats?▼

Yes, this approach supports both SPDX and CycloneDX SBOM formats, allowing you to generate software bills of materials for containers, language packages, and firmware bundles for enterprise compliance.

Can I use SLSA provenance and Sigstore signing for firmware bundles?▼

Yes, you can apply SLSA provenance and Sigstore signing to firmware bundles, ensuring tamper-evident release evidence and reproducible builds for software and firmware artifacts.

How do I enforce dependency vetting and reproducible builds for regulatory compliance?▼

You enforce dependency vetting and reproducible builds by implementing deterministic build policies and generating auditable release packages with accompanying provenance attestations for regulatory compliance audits.

Why do I need in-toto attestations for my npm and PyPI packages?▼

In-toto attestations secure your npm and PyPI packages by providing tamper-evident provenance evidence, verifying the build's integrity and ensuring the release artifacts meet enterprise-grade audit requirements.

Related Skills

Explore More Software Engineering Skills→
imsaifimsaif
3

Build & Deployment

Automate software builds into deterministic runnable artifacts across CI/CD workflows.

Community
Intermediate
williamzujkowskiwilliamzujkowski
6

Software Supply Chain Security Validator

Generate SBOMs, scan dependencies, and validate SLSA provenance attestations.

Community
Advanced
jeremylongshorejeremylongshore
2.6k

scanning-container-security

Scan container images and running containers for vulnerabilities using Trivy or Snyk.

Community
Intermediate
harnessharness
80

manage-supply-chain

Automates Harness SSCA configuration to generate SBOMs, sign artifacts with Cosign, and enforce OPA policies.

Official
Advanced