17 skills · sorted by relevance
Implement software supply chain integrity verification for container builds using the in-toto framework to create cryptographically signed attestations across CI/CD pipeline steps.
The English summary is being prepared. Showing the original description.
Assess software dependencies, build pipelines, and container images for security risks. Create a software component inventory, check vulnerabilities and license conflicts, verify artifact signatures, and prioritize fixes based on whether vulnerable code can actually be reached.
Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.
Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.
Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.
Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.
Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.
The English summary is being prepared. Showing the original description.
Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies.
The English summary is being prepared. Showing the original description.
Secure the AI model supply chain with artifact signing, provenance attestation, SBOM workflows, dependency controls, and trusted model promotion.
The English summary is being prepared. Showing the original description.
Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
The English summary is being prepared. Showing the original description.
Typosquatting detection, install script analysis, dependency confusion prevention, and phantom dependency detection for npm/pip.
The English summary is being prepared. Showing the original description.
Software supply chain security — SBOM generation and analysis, dependency confusion and typosquatting detection, malicious package indicators, CI/CD pipeline hardening, and artifact provenance/signing (SLSA, Sigstore)
The English summary is being prepared. Showing the original description.
供应链安全时使用。适用于依赖漏洞扫描 / 镜像安全 / CI 投毒防护 / SBOM。融合 SLSA + Sigstore + Snyk + Trivy。
The English summary is being prepared. Showing the original description.
Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.
The English summary is being prepared. Showing the original description.
Triage npm packages for install-script malware, exfiltration, and worming behavior.
The English summary is being prepared. Showing the original description.
Detect and prevent public-over-private name resolution in npm, PyPI, and Maven.
The English summary is being prepared. Showing the original description.
Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability Tespit across repositories at enterprise scale.
The English summary is being prepared. Showing the original description.