security-supply-chain

What problem does it solve?

This Skill addresses the critical and growing threat of supply chain attacks on open-source software by providing a comprehensive framework for securing Python packages.

Core Features & Use Cases

• Trusted Publishing: Replaces long-lived API tokens with secure OIDC tokens for PyPI publishing.
• Vulnerability Scanning: Integrates pip-audit to continuously scan dependencies for known vulnerabilities.
• Supply Chain Hardening: Implements best practices like Sigstore attestations, SLSA compliance, and CI permission hardening.
• Use Case: Ensure your critical Python library is protected against malicious takeovers and vulnerable dependencies by implementing all recommended security measures.

Quick Start

Implement trusted publishing for your Python package on PyPI.