# Supply Chain Security

> Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies.

- Skill: `johnson68878-ops/supply-chain-security` (Agent Skill, multi-file: 11 files)
- Install (CLI): `npx skillmds@latest add johnson68878-ops/supply-chain-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/johnson68878-ops/supply-chain-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: johnson68878-ops (https://skillmd.com/u/johnson68878-ops)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/johnson68878-ops/supply-chain-security

---


# Supply Chain Security

This skill packages the durable software supply chain security (SSSC) reference material: open-standard catalogs, the combined capabilities inventory, and the classification taxonomies used to assess a repository's posture and turn gaps into prioritized work items.

## When to use

Use this skill when you need to:

* Assess a repository against the 27 combined supply chain capabilities from hve-core and physical-ai-toolchain.
* Map posture against OpenSSF Scorecard, SLSA v1.0, OpenSSF Best Practices Badge, Sigstore (cosign), or NTIA SBOM minimum elements.
* Classify a gap by adoption category, effort size, or qualitative concern level.
* Derive work item priority and execution order from Scorecard risk levels.

## Skill layout

Load the reference file for the topic you need. Each file holds the verbatim standard catalog or taxonomy.

| Reference                                                                      | Topic                                                           |
|--------------------------------------------------------------------------------|-----------------------------------------------------------------|
| [references/00-index.md](references/00-index.md)                               | Navigation catalog for every reference in this skill            |
| [references/openssf-scorecard.md](references/openssf-scorecard.md)             | OpenSSF Scorecard 20 checks with risk levels and score ranges   |
| [references/slsa-levels.md](references/slsa-levels.md)                         | SLSA v1.0 Build track levels L0 through L3                      |
| [references/best-practices-badge.md](references/best-practices-badge.md)       | OpenSSF Best Practices Badge Passing, Silver, and Gold criteria |
| [references/sigstore-maturity.md](references/sigstore-maturity.md)             | Sigstore (cosign) adoption maturity levels                      |
| [references/sbom-elements.md](references/sbom-elements.md)                     | NTIA SBOM minimum elements and format guidance                  |
| [references/capabilities-inventory.md](references/capabilities-inventory.md)   | 27 combined capabilities across hve-core, PAT, and shared sets  |
| [references/adoption-categories.md](references/adoption-categories.md)         | Six adoption categories, effort sizing, and concern levels      |
| [references/scorecard-check-mapping.md](references/scorecard-check-mapping.md) | Full 20-check implementation and adoption reference mapping     |
| [references/priority-derivation.md](references/priority-derivation.md)         | Risk level to priority and execution order derivation           |

## Attribution

Standard catalogs in this skill derive from their respective upstream projects. Per-reference attribution appears at the bottom of each reference file. See [references/00-index.md](references/00-index.md) for the consolidated attribution summary.