# Supply Chain Hygiene

> Flag supply-chain hygiene gaps — unpinned image refs, TLS bypass, unjustified go.mod replace directives, curl|sh, moving-tag GitHub Actions (CWE-295, CWE-494).

- Skill: `kubernetes-sigs-kueue/supply-chain-hygiene` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kubernetes-sigs-kueue/supply-chain-hygiene`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kubernetes-sigs-kueue/supply-chain-hygiene/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: kubernetes-sigs (https://skillmd.com/u/kubernetes-sigs-kueue)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/kubernetes-sigs-kueue/supply-chain-hygiene

---


# Skill: Supply Chain Hygiene (CWE-295, CWE-494)

- Image references without a digest pin (`image: foo:latest` is a violation; require
  `@sha256:...`).
- `InsecureSkipVerify: true`, TLS verification bypass, or `--insecure` flags.
- `replace` directives in `go.mod` without a tracked issue and a target removal
  version.
- `curl | sh`, `wget | bash`, or scripts fetched from a URL inside a Dockerfile or
  Makefile.
- Third-party GitHub Actions / CI workflow steps pinned to a moving tag instead of a
  commit SHA.
- New direct dependencies without a one-line justification.