Run any Skill in Manus with one click

sbom-supply-chain

Stars16

Forks5

UpdatedMarch 6, 2026 at 16:13

Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain. Use when implementing SLSA controls, artifact trust policies, or compliance evidence for releases.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

Njones17

Njones17/AI-agent-master-cyber-skills-list

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	sbom-supply-chain
description	Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain. Use when implementing SLSA controls, artifact trust policies, or compliance evidence for releases.
license	MIT
metadata	{"author":"devops-skills","version":"1.0"}

SBOM & Supply Chain Security

Improve release trust with reproducible metadata and verification gates.

When to Use This Skill

Use this skill when:

Producing SBOMs for container images or application builds
Verifying dependencies before deploy
Enforcing signed artifact and provenance policies
Preparing for SOC2, ISO 27001, or customer security reviews

Recommended Tooling

SBOM generation: Syft, CycloneDX tools
Vulnerability matching: Grype, Trivy
Signing and attestations: Cosign, Sigstore
Policy enforcement: OPA, Kyverno, admission controllers

Baseline Workflow

Generate SBOM in SPDX or CycloneDX format during CI builds.
Create provenance attestations for build steps and source commit.
Sign image digests and SBOM artifacts with keyless or managed keys.
Verify signatures and attestations before deployment.
Archive evidence for audits and incident response.

Example Commands

# Generate SBOM for an image
syft registry:ghcr.io/acme/api:1.2.3 -o cyclonedx-json > sbom.json

# Sign container image digest
cosign sign ghcr.io/acme/api@sha256:abc123...

# Attach SBOM attestation
cosign attest --predicate sbom.json --type cyclonedx ghcr.io/acme/api@sha256:abc123...

# Verify signatures
cosign verify ghcr.io/acme/api@sha256:abc123...

Related Skills

dependency-scanning - Library vulnerability triage
container-scanning - Container CVE scanning
policy-as-code - Policy enforcement

More from this repository

same repository

ai-agent-security

Njones17/AI-agent-master-cyber-skills-list

Secure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls.

2026-03-0616

ai-red-teaming

Njones17/AI-agent-master-cyber-skills-list

Run structured AI red team exercises for jailbreak resistance, data exfiltration risk, harmful output controls, and agent tool abuse resilience.

2026-03-0616

burpsuite-project-parser

Njones17/AI-agent-master-cyber-skills-list

Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.

2026-03-0616

fastapi-security

Njones17/AI-agent-master-cyber-skills-list

Use when assessing security for Python FastAPI applications. Focuses on Pydantic exploitation, dependency injection gaps, OpenAPI exposure, ASGI middleware security, and Python-specific vulnerabilities like template injection and SSRF.

2026-03-0616

firebase-security

Njones17/AI-agent-master-cyber-skills-list

Security assessment methodology for Google Firebase applications, covering Firestore, Realtime Database, Cloud Storage, and Cloud Functions.

2026-03-0616

graphql-security

Njones17/AI-agent-master-cyber-skills-list

Use when testing GraphQL APIs for common vulnerabilities including introspection exploitation, authorization bypasses, batching abuse, and denial of service. Covers endpoint discovery, schema analysis, and exploitation of GraphQL-specific features like federation and directives.

2026-03-0616

name	sbom-supply-chain
description	Generate, sign, and verify SBOMs and provenance attestations to secure the software supply chain. Use when implementing SLSA controls, artifact trust policies, or compliance evidence for releases.
license	MIT
metadata	{"author":"devops-skills","version":"1.0"}

SBOM & Supply Chain Security

Improve release trust with reproducible metadata and verification gates.

When to Use This Skill

Use this skill when:

Producing SBOMs for container images or application builds
Verifying dependencies before deploy
Enforcing signed artifact and provenance policies
Preparing for SOC2, ISO 27001, or customer security reviews

Recommended Tooling

SBOM generation: Syft, CycloneDX tools
Vulnerability matching: Grype, Trivy
Signing and attestations: Cosign, Sigstore
Policy enforcement: OPA, Kyverno, admission controllers

Baseline Workflow

Generate SBOM in SPDX or CycloneDX format during CI builds.
Create provenance attestations for build steps and source commit.
Sign image digests and SBOM artifacts with keyless or managed keys.
Verify signatures and attestations before deployment.
Archive evidence for audits and incident response.

Example Commands

# Generate SBOM for an image
syft registry:ghcr.io/acme/api:1.2.3 -o cyclonedx-json > sbom.json

# Sign container image digest
cosign sign ghcr.io/acme/api@sha256:abc123...

# Attach SBOM attestation
cosign attest --predicate sbom.json --type cyclonedx ghcr.io/acme/api@sha256:abc123...

# Verify signatures
cosign verify ghcr.io/acme/api@sha256:abc123...

Related Skills

dependency-scanning - Library vulnerability triage
container-scanning - Container CVE scanning
policy-as-code - Policy enforcement