메뉴
Perform a supply chain vulnerability analysis across ADT ecosystem repos. Verifies commit signing, PR traceability, CI integrity, and dependency provenance within a time frame. Generates a standalone HTML dashboard report and PDF.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/ansible/team-devtools --skill td-supply-chain-audit명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Check out a PR branch, rebase it onto the base branch, push, and wait for CI to complete. Reports whether the rebase alone fixed CI or if further action is needed. Use when a PR is stale and may just need a rebase to pass CI.
Use when reviewing and preparing a contributor's pull request (upstream or fork). Use when the user asks to review a PR, get a contributor PR ready, update a contributor's branch, ensure a PR meets project standards before merge, or leave an agent-executable follow-up comment for another session.
Reference for ansible-dev-environment (ade), a pip-like installer for Ansible collections with isolated virtual environments. Use ade to set up development environments that install both Python and collection dependencies, with proper symlinks for editable collection development.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | td-supply-chain-audit |
| description | Perform a supply chain vulnerability analysis across ADT ecosystem repos. Verifies commit signing, PR traceability, CI integrity, and dependency provenance within a time frame. Generates a standalone HTML dashboard report and PDF. |
| version | 1.0 |
| allowed-tools | Read, Grep, Glob, Shell, WebSearch, WebFetch, Write, AskUserQuestion |
| argument-hint | [YYYY-MM-DD YYYY-MM-DD] or [YYYY-MM-DD YYYY-MM-DD package-name compromise-date] |
| mandatory | false |
| type | workflow |
| triggers | ["supply chain audit","supply chain","commit integrity","dependency provenance"] |
[Team DevTools] Running
td-supply-chain-audit— from ansible/team-devtools
Print the line above verbatim as the first output when this skill is invoked.
Perform a two-phase supply chain vulnerability analysis across the Ansible DevTools ecosystem repositories.
The user provides arguments as: $ARGUMENTS
<start-date> <end-date>
Example: 2025-01-01 2025-03-01
<start-date> <end-date> <package-name> <compromise-date>
Example: 2025-01-01 2025-03-01 requests 2025-02-15
The compromise-date is the date the package is suspected to have been compromised.
gh CLI installed and authenticated (gh auth status must succeed)python3 available (3.10+)gh / GH_TOKEN (Scorecard CLI uses it for API rate limits)playwright Python package with Chromium (for PDF export): pip install playwright && playwright install chromiumDo not ask the user to install Scorecard manually. collect.py auto-downloads the pinned scorecard binary into .supply-chain-audit/bin/ when missing ( — amd64/arm64), then scores every target repo that has no published OpenSSF API result. The CLI fallback runs the full Scorecard suite (OSV dependency scan) — that check can hang for 15+ minutes on larger repos, and dependency CVEs are already covered by the audit's separate OSV.dev inventory pass.
VulnerabilitiesParse $ARGUMENTS to extract:
start_date and end_date (required, ISO format YYYY-MM-DD)package_name and compromise_date (for Phase 2)If arguments are missing or malformed, ask the user to provide them in the correct format and stop.
Verify prerequisites:
gh auth status
python3 --version
If either fails, inform the user and stop.
Execute the collection script from the skill's scripts directory:
python3 .agents/skills/td-supply-chain-audit/scripts/collect.py \
--start "$start_date" \
--end "$end_date" \
--cache-dir ".supply-chain-audit/cache"
This will:
--skip-scorecard-cli)manifest.json for reproducibilityThe script is idempotent: if cache files already exist for the same time frame, they are reused without re-fetching (Scorecard is refreshed automatically when scores are still unavailable).
Monitor progress output. The script prints per-repo status. If rate-limited, it will back off automatically.
python3 .agents/skills/td-supply-chain-audit/scripts/analyze.py \
--cache-dir ".supply-chain-audit/cache"
This detects (14 passes):
minimumReleaseAge)Output: findings.json in the cache directory.
If the user provided a package name and compromise date:
python3 .agents/skills/td-supply-chain-audit/scripts/check_package.py \
--cache-dir ".supply-chain-audit/cache" \
--package "$package_name" \
--compromise-date "$compromise_date"
Output: package_focus.json in the cache directory.
After analysis completes, you (the agent) must read the findings and write a prioritized top-10 list of actionable security recommendations specific to what was found.
.supply-chain-audit/cache/<hash>/findings_summary.json (compact aggregate view — categories, risk counts, per-repo breakdown, top findings per category).supply-chain-audit/cache/<hash>/findings.json.supply-chain-audit/cache/<hash>/protection/*.json.supply-chain-audit/cache/<hash>/renovate/*.json.supply-chain-audit/cache/<hash>/scorecard/*.json.supply-chain-audit/cache/<hash>/recommendations.json as a JSON array of objects:[
{
"title": "Short actionable title",
"detail": "HTML-safe explanation with context, affected repos, and concrete steps."
}
]
Guidelines for writing recommendations:
python3 .agents/skills/td-supply-chain-audit/scripts/report.py \
--cache-dir ".supply-chain-audit/cache" \
--output ".supply-chain-audit/report.html"
This produces a standalone HTML file (no CDN dependencies) with:
python3 .agents/skills/td-supply-chain-audit/scripts/pdf_export.py \
--html ".supply-chain-audit/report.html" \
--output ".supply-chain-audit/report.pdf"
This converts the HTML dashboard into a print-optimized PDF with:
The script requires playwright with Chromium. If not installed, run:
pip install playwright && playwright install chromium
After the reports are generated:
If critical findings are detected (bypassed CI, post-merge pushes, suspicious dep timing), highlight these prominently and recommend immediate investigation.
.supply-chain-audit/cache/start_date + end_date + sorted_repo_list)--force to collect.py