supply-chain-hygiene

Sterne2.737

Forks699

Aktualisiert1. Juni 2026 um 15:28

Flag supply-chain hygiene gaps — unpinned image refs, TLS bypass, unjustified go.mod replace directives, curl|sh, moving-tag GitHub Actions (CWE-295, CWE-494).

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

In Manus ausführen

Quelle

kubernetes-sigs

kubernetes-sigs/kueue

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

In Manus ausführen

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

InformationssicherheitsanalystenInformatik- und Mathematikberufe·SOC 15-1212

SKILL.md

readonly

name	supply-chain-hygiene
description	Flag supply-chain hygiene gaps — unpinned image refs, TLS bypass, unjustified go.mod replace directives, curl\|sh, moving-tag GitHub Actions (CWE-295, CWE-494).
license	Apache-2.0
metadata	{"copyright":"The Kubernetes Authors"}

Skill: Supply Chain Hygiene (CWE-295, CWE-494)

Image references without a digest pin (image: foo:latest is a violation; require @sha256:...).
InsecureSkipVerify: true, TLS verification bypass, or --insecure flags.
replace directives in go.mod without a tracked issue and a target removal version.
curl | sh, wget | bash, or scripts fetched from a URL inside a Dockerfile or Makefile.
Third-party GitHub Actions / CI workflow steps pinned to a moving tag instead of a commit SHA.
New direct dependencies without a one-line justification.

Mehr aus diesem Repository

gleiches Repository

was-cluster

kubernetes-sigs/kueue

Build and manage a kind cluster for Workload-Aware Scheduling (WAS) e2e tests. Use when the user wants to set up, run tests against, or tear down a WAS test cluster built from Kubernetes main.

2026-07-102.7k

avoidable-complexity

kubernetes-sigs/kueue

Flag solutions more elaborate than the problem requires — complexity that exists only because the author reached for a pattern.

2026-06-012.7k

duplicated-logic

kubernetes-sigs/kueue

Flag identical (or near-identical) blocks across types/adapters/call sites that should live in a shared helper — and newly extracted helpers with only one caller.

2026-06-012.7k

illogical-structure

kubernetes-sigs/kueue

Flag code organization that a future maintainer will struggle to follow, modify, or extend.

2026-06-012.7k

misplaced-logic

kubernetes-sigs/kueue

Flag code put somewhere a reader would not expect to find it — cleanup scattered across callers, validation deep in business logic.

2026-06-012.7k

nonsensical-decisions

kubernetes-sigs/kueue

Flag unnecessary indirection, mismatched abstractions, or confusing data flow that obscures what the code is doing.

2026-06-012.7k

name	supply-chain-hygiene
description	Flag supply-chain hygiene gaps — unpinned image refs, TLS bypass, unjustified go.mod replace directives, curl\|sh, moving-tag GitHub Actions (CWE-295, CWE-494).
license	Apache-2.0
metadata	{"copyright":"The Kubernetes Authors"}

Skill: Supply Chain Hygiene (CWE-295, CWE-494)

Image references without a digest pin (image: foo:latest is a violation; require @sha256:...).
InsecureSkipVerify: true, TLS verification bypass, or --insecure flags.
replace directives in go.mod without a tracked issue and a target removal version.
curl | sh, wget | bash, or scripts fetched from a URL inside a Dockerfile or Makefile.
Third-party GitHub Actions / CI workflow steps pinned to a moving tag instead of a commit SHA.
New direct dependencies without a one-line justification.