Plugins
2 pluginsResults for “supply-chain”
14 skills
github agent-supply-chain
Verify supply chain integrity for AI agent plugins, tools, and dependencies by generating SHA-256 manifests, detecting tampered files, auditing dependency pinning, and enforcing promotion gates.
36.2k
mukul975 analyzing-supply-chain-malware-artifacts
Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.
24.6k · bundle
mukul975 detecting-supply-chain-attacks-in-ci-cd
Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure.
24.6k · bundle
getsentry skill-scanner
Scans agent skills for security issues including prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.
845 · bundle
github github-actions-hardening
Reviews and hardens GitHub Actions workflows against injection, privilege escalation, supply-chain, and token-scoping risks that pattern matchers miss.
36.2k · bundle
mukul975 implementing-code-signing-for-artifacts
Sign build artifacts (binaries, packages, containers) with GPG, Sigstore, and platform-specific tools to ensure integrity and authenticity throughout the software supply chain.
24.6k · bundle
More results
mukul975 implementing-supply-chain-security-with-in-toto
Verify container image integrity across CI/CD pipelines using the in-toto framework to generate and check cryptographically signed attestations.
24.6k · bundle
mukul975 verifying-build-provenance-with-slsa-sigstore
Verify signed artifacts and SLSA build provenance with Sigstore cosign and slsa-verifier, enforce keyless OIDC identity, and apply SLSA Build levels to harden the software supply chain.
24.6k · bundle
mukul975 securing-github-actions-workflows
Hardens GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation by pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, preventing script injection, and implementing workflow change controls.
24.6k · bundle
mukul975 detecting-malicious-npm-packages
Triage npm packages for install-script malware, exfiltration, and worming behavior using GuardDog, manual inspection, and safe detonation.
24.6k · bundle
mukul975 implementing-image-provenance-verification-with-cosign
Sign and verify container image provenance using Sigstore Cosign with keyless OIDC-based signing, attestations, and Kubernetes admission enforcement.
24.6k · bundle
zhaoxuya520 thick-client
Authorized security testing framework for desktop thick clients covering local storage, IPC, update channels, traffic interception, and client-side trust boundaries.
12.8k · bundle
mukul975 implementing-sigstore-for-software-signing
Signs and verifies software artifacts using Sigstore's keyless signing, Rekor transparency log, and Fulcio certificate authority, integrating into CI/CD pipelines and Kubernetes admission controls.
24.6k · bundle
mukul975 securing-container-registry-images
Scan container images for vulnerabilities with Trivy and Grype, generate SBOMs, sign images with Cosign and Sigstore, configure registry access controls, and enforce security gates in CI/CD pipelines.
24.6k · bundle