What problem does it solve? Modern applications depend on hundreds of third-party components, and teams struggle to know which dependencies are vulnerable, whether CI/CD pipelines are tamper-proof, and whether container images can be trusted. This Skill provides a repeatable six-layer methodology for auditing the entire software supply chain instead of guessing at ad-hoc scans. ## Core Features & Use Cases - SBOM Generation and Audit: Generate CycloneDX or SPDX bills of materials with cdxgen, Syft, or sbom-tool, then audit for unknown, abandoned, or license-conflicting dependencies. - SCA and Vulnerability Reachability: Scan with OSV-Scanner, Trivy, Dependency-Track, or Snyk, then verify which CVEs are actually reachable using data-flow analysis and PoC validation instead of trusting raw alert counts. - CI/CD and Container Hardening: Audit GitHub Actions/GitLab CI configurations for injection and permission risks, scan images with Trivy, and sign artifacts with Cosign. - Use Case: Before a compliance review, generate an SBOM for your application, scan it for critical CVEs, verify reachability of the top findings, and produce a prioritized remediation list with evidence. ## Quick Start Use the supply-chain-security skill to generate an SBOM for this repository and audit its dependencies for reachable critical vulnerabilities.
