supply-chain-security

Name: supply-chain-security
Availability: InStock
Author: brucesongs

Audit dependencies, generate SBOMs, and harden CI/CD pipelines.

60|14|Updated Apr 27, 2026

Search Tags:#security #vulnerability #provenance #supply-chain #ci-cd #signatures #sbom

Ready to run

npx skills add https://github.com/brucesongs/kali-claw --skill supply-chain-security-brucesongs

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supply-chain-security
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/supply-chain-security
Command: npx skills add https://github.com/brucesongs/kali-claw --skill supply-chain-security-brucesongs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Software supply chain security is critical to protect code, dependencies, and deployment pipelines from vulnerabilities, tampering, and supply chain attacks.

Core Features & Use Cases

SBOM generation and analysis to map components, licenses, and risk.
Vulnerability detection & remediation planning across dependencies, CI/CD configs, and build pipelines.
Threat modeling for supply chain attacks including dependency confusion and typosquatting, with defensive controls such as private registries and SBOM-based risk scoring.
CI/CD hardening & secret management with provenance and signature verification.

Quick Start

Run the scanner on your project to discover and remediate supply chain risks in seconds.

Frequently Asked Questions about supply-chain-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate an SBOM for a multi-language project?▼

Generating an SBOM for a multi-language project involves scanning Node, Python, Go, and container environments to map components, licenses, and risks, outputting standard CycloneDX or SPDX formats for comprehensive dependency analysis.

What is the best way to detect dependency confusion and typosquatting risks?▼

Detecting dependency confusion and typosquatting risks requires threat modeling your software supply chain, applying defensive controls like private registries and SBOM-based risk scoring to identify and mitigate malicious package vulnerabilities.

How does provenance validation work in a CI/CD pipeline?▼

Provenance validation in a CI/CD pipeline works by integrating in-toto and SLSA frameworks to verify artifact signatures using Sigstore, ensuring build integrity and preventing tampering throughout the deployment process.

Can I use Trivy and OSV for vulnerability scanning across different languages?▼

Yes, you can use Trivy and OSV for vulnerability scanning across Node, Python, and Go projects. The Skill integrates these scanners to detect dependency flaws and plan policy-based remediation across your codebase.

Does this supply chain security tool support signature verification with Sigstore?▼

Yes, this supply chain security tool supports signature verification with Sigstore. It enables provenance validation and CI/CD hardening by verifying signatures to secure deployment pipelines against tampering.