“supply-chain-security”的搜索结果

Implement software supply chain integrity verification for container builds using the in-toto framework to create cryptographically signed attestations across CI/CD pipeline steps.

中文简介正在准备中。当前显示原文说明。

Assess software dependencies, build pipelines, and container images for security risks. Create a software component inventory, check vulnerabilities and license conflicts, verify artifact signatures, and prioritize fixes based on whether vulnerable code can actually be reached.

中文简介正在准备中。当前显示英语简介。

• Creating and auditing a software component inventory
• Prioritizing dependency vulnerabilities by actual exposure
• Auditing CI/CD pipelines and secret handling

Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.

中文简介正在准备中。当前显示英语简介。

• Screening a new dependency before installation
• Reviewing dependency lists generated by AI
• Checking lockfile changes for swapped packages

Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.

中文简介正在准备中。当前显示英语简介。

• Reviewing GitHub Actions workflow security
• Checking action version pinning
• Finding unsafe event expressions in scripts

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

中文简介正在准备中。当前显示英语简介。

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.

中文简介正在准备中。当前显示英语简介。

• Auditing projects that mix private and public package registries
• Checking exposure after internal package names have leaked
• Restricting package sources to approved private registries

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

中文简介正在准备中。当前显示原文说明。

Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies.

中文简介正在准备中。当前显示原文说明。

Secure the AI model supply chain with artifact signing, provenance attestation, SBOM workflows, dependency controls, and trusted model promotion.

中文简介正在准备中。当前显示原文说明。

Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.

中文简介正在准备中。当前显示原文说明。

Typosquatting detection, install script analysis, dependency confusion prevention, and phantom dependency detection for npm/pip.

中文简介正在准备中。当前显示原文说明。

Software supply chain security — SBOM generation and analysis, dependency confusion and typosquatting detection, malicious package indicators, CI/CD pipeline hardening, and artifact provenance/signing (SLSA, Sigstore)

中文简介正在准备中。当前显示原文说明。

供应链安全时使用。适用于依赖漏洞扫描 / 镜像安全 / CI 投毒防护 / SBOM。融合 SLSA + Sigstore + Snyk + Trivy。

中文简介正在准备中。当前显示原文说明。

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.

中文简介正在准备中。当前显示原文说明。

Triage npm packages for install-script malware, exfiltration, and worming behavior.

中文简介正在准备中。当前显示原文说明。

Detect and prevent public-over-private name resolution in npm, PyPI, and Maven.

中文简介正在准备中。当前显示原文说明。

Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability Tespit across repositories at enterprise scale.

中文简介正在准备中。当前显示原文说明。