backnotprop/oss-security-audit

Profil backnotprop

Dernière activité source enregistrée: 9 avril 2026 à 06:47

Catalogue SkillsMP mis à jour: 26 octobre 2026 à 11:37

skills collectés: 1

Étoiles GitHub: 17
Forks GitHub: 1

README du dépôt

Fichier source du README : README.md

Lire le README source

Afficher le README complet

# oss-security-audit An agent skill that audits an open-source repository's supply chain security posture and produces an HTML report. Methodology is based on [Astral's OSS security framework](https://astral.sh/blog/open-source-security-at-astral) (April 2026), covering: 1. CI/CD workflow security (triggers, action pinning, permissions, secret isolation) 2. Repository and organizational controls (branch/tag rulesets, 2FA, admin bypass) 3. Release security (Trusted Publishing, deployment environments, approvals, attestations, immutable releases) 4. Automations (GitHub Apps vs Actions for privileged triggers) 5. Dependency hygiene (automated updates, cooldowns, vuln surfacing, footprint) Works against GitHub or GitLab. Read-only. The skill runs a preflight access check and asks the user to grant anything it's missing. ## Install _Claude Code_ ``` git clone https://github.com/backnotprop/oss-security-audit ~/.claude/skills/oss-security-audit ``` _Codex_ ``` git clone https://github.com/backnotprop/oss-security-audit ~/.codex/skills/oss-security-audit ``` _Agents_ ``` git clone https://github.com/backnotprop/oss-security-audit ~/.agents/skills/oss-security-audit ``` ## Use In an agent session, from inside the repo you want to audit: > `/oss-security-audit` The skill triggers, walks through the five domains, and writes `oss-security-audit-report.html` to the repo root. ## Layout ``` SKILL.md # methodology + workflow assets/report-template.html # self-contained HTML report template ``` No bundled scanner. The audit is LLM-driven end to end.

Chargement du README du dépôt…

Skills dans ce dépôt

Analystes en sécurité de l'information

1 catégories métier · 100% classifié

skill

métier

description

mis à jour

oss-security-audit

Analystes en sécurité de l'information

Audits the CI/CD pipeline, repository, release process, automations, and dependency hygiene of an open-source software supply chain, then produces an elegant HTML report of findings and recommendations. Use this skill whenever the user asks to assess, audit,…

Langue du texte source : anglais

2026-04-09

Affichage de 1 skills collectés sur 1.

Installer avec un assistant IA

Copiez ce prompt dans l’assistant IA que vous utilisez.

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/backnotprop/oss-security-audit.