What problem does it solve? Modern software depends on untrusted supply chains where dependencies can be substituted, builds tampered with, and artifacts impersonated. This Skill gives an AI agent production-grade defensive knowledge to generate and verify SBOMs, block dependency confusion and typosquatting, triage suspicious packages, enforce SLSA provenance levels, and verify Sigstore signatures before artifacts reach production. ## Core Features & Use Cases - SBOM Generation & Verification: Guidance on SPDX vs CycloneDX selection, NTIA minimum elements, build-time generation, and signed SBOM attestations. - Dependency-Confusion & Typosquatting Defense: Namespace scoping, source pinning, lockfile hash-pinning, and name-similarity checks to prevent package substitution. - Malicious-Package Triage Playbook: Detection signals (maintainer changes, install scripts, network access) and a five-step quarantine-to-report response procedure. - SLSA & Sigstore Verification: Provenance level requirements (L0-L3) and cosign keyless signing verification with expected signer identity pinning. - Use Case: Before adding a new npm dependency, ask the agent to triage it — it will check for typosquat signals, verify provenance, and confirm the lockfile pins content hashes. ## Quick Start Ask the agent to audit your project's dependency and release pipeline for supply-chain risks and produce a hardening checklist covering SBOM generation, hash pinning, and artifact signature verification.
