backnotprop/oss-security-audit

backnotprop 资料

最近记录的来源活动: 2026年4月9日 06:47

SkillsMP 收录数据更新: 2026年10月17日 00:09

已收集 skills: 1

GitHub 星标: 17
GitHub Forks: 1

仓库 README

仓库 README 来源：README.md

查看 README 源文件

展开完整 README

# oss-security-audit An agent skill that audits an open-source repository's supply chain security posture and produces an HTML report. Methodology is based on [Astral's OSS security framework](https://astral.sh/blog/open-source-security-at-astral) (April 2026), covering: 1. CI/CD workflow security (triggers, action pinning, permissions, secret isolation) 2. Repository and organizational controls (branch/tag rulesets, 2FA, admin bypass) 3. Release security (Trusted Publishing, deployment environments, approvals, attestations, immutable releases) 4. Automations (GitHub Apps vs Actions for privileged triggers) 5. Dependency hygiene (automated updates, cooldowns, vuln surfacing, footprint) Works against GitHub or GitLab. Read-only. The skill runs a preflight access check and asks the user to grant anything it's missing. ## Install _Claude Code_ ``` git clone https://github.com/backnotprop/oss-security-audit ~/.claude/skills/oss-security-audit ``` _Codex_ ``` git clone https://github.com/backnotprop/oss-security-audit ~/.codex/skills/oss-security-audit ``` _Agents_ ``` git clone https://github.com/backnotprop/oss-security-audit ~/.agents/skills/oss-security-audit ``` ## Use In an agent session, from inside the repo you want to audit: > `/oss-security-audit` The skill triggers, walks through the five domains, and writes `oss-security-audit-report.html` to the repo root. ## Layout ``` SKILL.md # methodology + workflow assets/report-template.html # self-contained HTML report template ``` No bundled scanner. The audit is LLM-driven end to end.

正在加载仓库 README…

这个仓库中的 skills

信息安全分析师

1 个职业分类 · 已分类 100%

skill

职业分类

描述

更新

oss-security-audit

信息安全分析师

Audits the CI/CD pipeline, repository, release process, automations, and dependency hygiene of an open-source software supply chain, then produces an elegant HTML report of findings and recommendations. Use this skill whenever the user asks to assess, audit,…

原文语言：英语

2026-04-09

已展示 1 / 1 个已收集 Skill。

用 AI 助手安装

复制这段 Prompt，发给你正在使用的 AI 助手。

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/backnotprop/oss-security-audit.