agentskills.codes
SU

supply_chain_security

by zerAdaSecuritySource

Automates Docker image security, including signing, SBOM generation, and provenance tracking.

Security AuditDevopsCI/CDDockerKubernetes

Install

mkdir -p .claude/skills/supply-chain-security && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/14519" && unzip -o skill.zip -d .claude/skills/supply-chain-security && rm skill.zip

Installs to .claude/skills/supply-chain-security

Activation

This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.

Docker image signing (Cosign), SBOM generation, SLSA provenance attestation, GHCR registry management.
102 charsno explicit “when” trigger
Intermediate

Key capabilities

  • →Sign Docker images using Cosign
  • →Generate Software Bill of Materials (SBOM)
  • →Create SLSA provenance attestations for builds
  • →Manage GitHub Container Registry (GHCR) images
  • →Verify image integrity

How it works

The skill uses Cosign for image signing with a key pair and generates SBOMs and SLSA provenance attestations during the build process. It also enforces SHA-pinning for GitHub Actions and checks version consistency across project files.

Inputs & outputs

You give it
Docker images and build artifacts
You get back
Signed Docker images, SBOMs, SLSA provenance attestations, and security audit reports

When to use supply_chain_security

  • →Signing Docker images for production
  • →Generating SBOMs for compliance
  • →Attesting image provenance

About this skill

Supply Chain Security (RESTO BOT)

Docker image pipeline

  • Build: project/.github/workflows/build-push-artifacts.yml
  • Registry: GitHub Container Registry (GHCR)
  • Images built: gateway, admin-dashboard, kiosk-app, cms (Strapi)

Signing and attestation

  • Cosign: Image signing with key pair
    • Secrets: COSIGN_PASSWORD, COSIGN_PRIVATE_KEY (GitHub Actions secrets)
    • Verify: cosign verify --key cosign.pub <image>
  • SBOM: Software Bill of Materials generated per build
  • SLSA Provenance: Attestation for build reproducibility

SHA-pinning policy

  • All GitHub Actions must use SHA-pinned references
  • Example: uses: actions/checkout@sha256:... (not @v4)
  • Enforced in CI lint step

Version consistency

  • N8N_VERSION must match across:
    • project/.env
    • project/.github/workflows/ci.yml
    • project/.github/workflows/security-scan.yml
  • Base images pinned in Dockerfiles and compose

Image inventory

ImageSourceSigned
nginx:1.27-alpineDocker HubN/A (upstream)
n8n:1.80.0docker.n8n.ioN/A (upstream)
postgres:15-alpineDocker HubN/A (upstream)
redis:7-alpineDocker HubN/A (upstream)
traefik:v3.6.6Docker HubN/A (upstream)
ollama:0.6.2Docker HubN/A (upstream)
gateway (custom)GHCRCosign
admin-dashboard (custom)GHCRCosign
kiosk-app (custom)GHCRCosign
cms (custom)GHCRCosign

Key files

  • project/.github/workflows/build-push-artifacts.yml
  • project/.github/workflows/security-scan.yml (Trivy)
  • project/admin-dashboard/Dockerfile
  • project/kiosk-app/Dockerfile
  • project/inventory-cms/Dockerfile

Required output

  • Signing verification evidence
  • SBOM generation confirmation
  • SHA-pin audit for GitHub Actions
  • Version consistency check

When not to use it

  • →The project does not use Docker images
  • →The project does not require supply chain security practices
  • →There is no access to Cosign keys or GHCR

Prerequisites

COSIGN_PASSWORDCOSIGN_PRIVATE_KEY

Limitations

  • →Requires GitHub Actions for build pipeline integration
  • →Relies on Cosign for signing and verification
  • →Upstream images from Docker Hub are not signed by this process

How it compares

This skill automates and enforces specific supply chain security practices like image signing and provenance attestation, providing a verifiable security posture beyond basic image builds.

Compared to similar skills

supply_chain_security side by side with the closest alternatives in the catalog.

SkillInstallsUpdatedSafetyDifficulty
supply_chain_security (this skill)04moReviewIntermediate
secrets-management54moReviewAdvanced
odoo-image-supply-chain04moNo flagsAdvanced
container-security-testing17moReviewIntermediate

Try saying

Example prompts that trigger this skill in your AI assistant.

You might also like

secrets-management

wshobson

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

585

odoo-image-supply-chain

Insightpulseai

Close container image supply-chain gap with automated ACR builds, vulnerability scanning, and image signing

00

container-security-testing

Ed1s0nZ

容器安全测试的专业技能和方法论

14

sca-trivy

rohunj

Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license compliance risks. Use when: (1) Scanning container images and filesystems for vulnerabilities and misconfigurations, (2) Analyzing dependencies for known CVEs across multiple languages (Go, Python, Node.js, Java, etc.), (3) Detecting IaC security issues in Terraform, Kubernetes, Dockerfile, (4) Integrating vulnerability scanning into CI/CD pipelines with SARIF output, (5) Generating Software Bill of Materials (SBOM) in CycloneDX or SPDX format, (6) Prioritizing remediation by CVSS score and exploitability.

12

security-automation

Ed1s0nZ

安全自动化的专业技能和方法论

12

opnsense

MylesLandais

OPNsense firewall + router for the SecretCon lab, deployed as a Proxmox VM in front of vmbr1

00

Search skills

Search the agent skills registry