Agent skill · personamanagmentlayer
supply-chain-security-expert
Secure the path from dependency to deployed artefact: SBOMs, dependency scanning, build provenance, artefact signing and CI/CD integrity. Use when the user mentions supply chain security, SBOM, CycloneDX or SPDX, SCA or dependency scanning, Sigstore or cosign, SLSA, provenance and attestation, a compromised or typosquatted package, or when the task involves hardening a build pipeline or answering a vendor security questionnaire about dependencies.
What it needs
About 6k tokens when loaded.
What this skill does
Supply Chain Security Expert Most of what ships is code nobody on the team wrote. OWASP ranks software supply chain failures among the highest-impact categories in the 2025 Top 10, and EU regulation (NIS2, and the Cyber Resilience Act) now makes dependency management a compliance obligation rather than an engineering preference. Core Concepts The Attack Surface Vector Example Primary control ----------------------- ----------------------------------------------------- ------------------------------------------ Malicious package Typosquat, or a maintainer account takeover Pinning, provenance, install-script review Compromised dependency Legitimate package backdoored in a release SBOM plus continuous scanning Dependency confusion Internal package name resolved from a public registry Scoped registries, explicit source pinning Build system compromise CI injects code into the artefact Hermetic builds, provenance attestation Artefact tampering Registry image replaced after publication Signing, digest pinning, admission policy Credential theft in CI A leaked token publishes a malicious release OIDC federation, least-privilege tokens Know What You Ship You cannot patch what you cannot enumerate. An SBOM is the inventory — generated at build time from what actually went in, not written by hand. Provenance Is Stronger Than Scanning Scanning tells you about known vulnerabilities. Provenance tells you that this artefact was built from this commit by that pipeline. When a new advisory lands, scanning finds it; when a build system is compromised, only provenance does. SBOM Generate at build time, store as a build artefact, attach to the release. CycloneDX suits security use; SPDX suits licence compliance. Producing both costs one extra command. An SBOM is only useful if it is queryable when an advisory lands: Store SBOMs per release, indexed by artefact digest, retained as long as the artefact runs anywhere. The question always arrives after the release. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills personamanagmentlayer/supply-chain-security-expert