# Transparent Code Engine

> SBOM, SLSA provenance, Action pin, release integrity. Defense-only TC controls.

- Skill: `metinduraktr-44/transparent-code-engine` (Agent Skill, multi-file: 25 files)
- Install (CLI): `npx skillmds@latest add metinduraktr-44/transparent-code-engine`
- Raw SKILL.md: https://api.skillmd.com/api/skills/metinduraktr-44/transparent-code-engine/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: metinduraktr-44 (https://skillmd.com/u/metinduraktr-44)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/metinduraktr-44/transparent-code-engine

---


# GUARDRAIL AKTİF — savunma-only, secret-redakte, exploit-yok

# transparent-code-engine

## Trigger
SBOM, SLSA, provenance, Action SHA pin, supply chain, TC-xxx.

## Hybrid
`references/sbom-slsa.md` + `references/gha-pin-policy.md`

## MODE
ASSESS-ONLY. Supply-chain saldırı simülasyonu / exploit yok.

## Procedure
1. `SECURITY_RESEARCH/supply-chain.md` oku
2. Workflow bağımlılık envanteri
3. Pin/SBOM/provenance gap
4. TC kontrolleri
5. Matrix + tarama

## TODO
20k: CycloneDX örnek pipeline, Scorecard skor yorumu, attestation verify runbook.

## Depth status
Bu tur ~3816 karakter (SKILL+references). **Kalan ~20k hedefe:** ~16184. Sonraki: ek kanonik özet + holding örnekleri (padding yok).