القائمة
AI supply chain security review — model provenance, AI-BOM, embedding integrity, framework dependencies, third-party APIs
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | supply-chain-review |
| description | AI supply chain security review — model provenance, AI-BOM, embedding integrity, framework dependencies, third-party APIs |
User runs /supply-chain-review followed by a system description, or provides a model card, dependency manifest, or architecture doc.
| Check | How to Verify | Risk if Missing |
|---|---|---|
| Source is a known-trusted registry | HuggingFace (verified org), commercial API (OpenAI, Anthropic, Cohere), or internal registry | HIGH — unknown source may be trojanized |
| Model card exists | Read the model card: data sources, intended use, known limitations, eval results | MED — no insight into training data scope or bias |
| Version is pinned | Code references an exact model version/tag, not latest | MED — silent model drift; behavioral regression without notice |
| Cryptographic integrity verified | SHA256 hash or OMS signature checked at deploy time | HIGH — tampered weights deploy silently |
| License is approved | License reviewed against organization's approved list | MED — GPL-contaminated weights may create IP risk |
| Check | How to Verify | Risk if Missing |
|---|---|---|
| Data sources documented | Explicit list of datasets used (public + proprietary) | HIGH — poisoned training data undetectable at inference time |
| PII scrub confirmed | Evidence of PII scan + redaction before fine-tuning | HIGH — model may memorize and regurgitate PII |
| Data lineage tracked | Can trace each training artifact to its origin | MED — no forensics path if poisoning suspected |
| Consent / licensing verified for public datasets | License reviewed for commercial use and model training permission | MED — IP and regulatory exposure |
| Check | How to Verify | Risk if Missing |
|---|---|---|
| Embedding model is version-pinned | Exact model name + version in code/config, not resolved dynamically | HIGH — embedding space drift breaks retrieval silently |
| Source verified (same as L1) | Same provenance checks as foundation model | HIGH |
| Hash verified at load time | Embedding model weights checked against known good hash | MED — tampered embeddings corrupt entire vector store |
| Embedding model change triggers re-index | Process exists to re-embed corpus when model changes | MED — stale embeddings with new model = semantic drift |
| Check | How to Verify | Risk if Missing |
|---|---|---|
| All AI/ML dependencies pinned to exact versions | requirements.txt / pyproject.toml / package-lock.json with exact versions | HIGH — transitive dependency attack surface |
| SBOM generated | SBOM (CycloneDX or SPDX 3.0) exists for the deployment artifact | MED — no inventory = no vulnerability scanning |
| CVE scan runs in CI | Dependency scan in pipeline (e.g., pip-audit, trivy, snyk) | HIGH — known CVEs in ML libs go unpatched |
Unpinned latest tags blocked | CI fails if latest or unversioned deps detected | MED — silent upgrades introduce breaking changes |
| Check | Trust Level | Criteria |
|---|---|---|
| Internal / first-party tool | TRUSTED | Owned, audited, signed, versioned |
| Major platform API (OpenAI, Azure, AWS, GCP) | CONDITIONAL | DPA signed, SOC2, data residency confirmed |
| Open-source community plugin | CONDITIONAL | Actively maintained, pinned version, CVE-scanned |
| Unknown / community-contributed plugin | UNTRUSTED | Block until provenance verified |
| Third-party data enrichment API | CONDITIONAL | Data egress reviewed, PII classification applied |
Flag any UNTRUSTED component as [RISK: HIGH] — it blocks production until resolved.
An AI-BOM extends a traditional SBOM to cover model-specific artifacts. Check for:
| Field | Required? | Notes |
|---|---|---|
| Base model name + version + source URL | Yes | |
| Base model hash / OMS signature | Yes | |
| Embedding model name + version + hash | Yes | |
| Training datasets (name, version, license) | Yes | |
| Fine-tuning data sources | Yes if fine-tuned | |
| Framework versions (LangChain, LlamaIndex, etc.) | Yes | |
| Third-party APIs and their DPA status | Yes | |
| Model card reference | Yes | |
| Last updated date | Yes |
If no AI-BOM exists: flag [RISK: HIGH] — recommend generating one using SPDX 3.0 AI/ML fields.
| Level | Meaning | Deployment Gate |
|---|---|---|
| TRUSTED | Provenance verified, signed, pinned, licensed, scanned | No gate — proceed |
| CONDITIONAL | Partially verified; known risk with mitigations in place | Document mitigation; approved before prod |
| UNTRUSTED | Provenance unknown or unverifiable | Blocks production until resolved |
Date: [today]
Scope: [models, data, frameworks, APIs reviewed]
Overall Posture: [GREEN / AMBER / RED]
| Layer | Components Reviewed | Trust Level | Open Risks |
|---|---|---|---|
| Foundation model | |||
| Training / fine-tune data | |||
| Embedding model | |||
| Frameworks & libraries | |||
| Plugins & third-party APIs | |||
| AI-BOM |
| # | Layer | Component | Risk | Severity | Blocks Prod? | Recommended Action |
|---|
Before deploying to production, the following must be confirmed:
Audit a Google ADK tool file against the five known gotchas (DI params, thin wrappers, _j helper, async-wrap blocking calls, httpx context manager) before they bite in production
After creating an ADR, run the cross-referencing checklist — update README Artifacts table, add Related Decisions section to source proposal, cross-link sibling ADRs to each other
Mid-task durability — dump current state and a next-step file before context fills, so the next session resumes without re-deriving where you were
Generate and verify a pre-demo checklist for an ADK/agent project — env vars, GCP auth, embedding swap, ngrok/Slack wiring, dry-run, tests, real-vs-synthetic data
Scan a project's docs (README, CLAUDE.md, ADRs, runbooks) for inconsistent project naming, scope, or framing — catches the "README says retail, CLAUDE.md still says Kroger" class of bug
Refresh a project's status — derive current state from code/tests/git, regenerate the project's status memory entry and (if requested) a status section in the README
