菜单
Govern third-party and OSS dependencies via SBOM, SLSA, OpenSSF Scorecard, and license policy. Use when establishing supply-chain controls, responding to CVE pressure, or preparing for SOC 2 / EU CRA audits.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | dependency-governance |
| description | Govern third-party and OSS dependencies via SBOM, SLSA, OpenSSF Scorecard, and license policy. Use when establishing supply-chain controls, responding to CVE pressure, or preparing for SOC 2 / EU CRA audits. |
Modern systems are mostly other people's code. Dependency governance turns supply chain into a managed risk: every artifact has a verified provenance, a Software Bill of Materials, a license posture, and a refresh cadence enforced in CI and at admission.
| Concern | Recommended |
|---|---|
| SBOM format | CycloneDX 1.6, SPDX 3.0 |
| Provenance | SLSA v1.0 (target Build L3), in-toto attestations |
| Signing | Sigstore (cosign), Rekor transparency log |
| Health scoring | OpenSSF Scorecard, deps.dev |
| Vulnerability | OSV.dev, GitHub Advisory, Trivy, Grype, Dependency-Track |
| License | ScanCode, FOSSA, ORT; SPDX expressions |
| Updates | Renovate / Dependabot with grouped, scheduled PRs |
| Admission | Kyverno / OPA Gatekeeper verifying signatures + SBOM |
| Regulation | EU Cyber Resilience Act 2024, US EO 14028, NIST SSDF |
flowchart LR
S[Source] --> B[Build w/ SLSA provenance]
B --> SB[Generate CycloneDX SBOM]
SB --> SC[Sign w/ cosign + Rekor]
SC --> R[Push to registry]
R --> A{Admission}
A -->|verify sig + SBOM + scorecard| K[Deploy]
A -->|fail| X[Block + alert]
K --> M[Continuous scan: OSV, license]
# .github/workflows/build.yml (excerpt)
permissions: { id-token: write, contents: read, attestations: write }
jobs:
build:
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
sbom:
steps:
- run: syft packages dir:. -o cyclonedx-json > sbom.cdx.json
- run: cosign attest --predicate sbom.cdx.json --type cyclonedx $IMAGE
# Conftest license policy
package licenses
deny[msg] {
pkg := input.components[_]
banned := {"AGPL-3.0", "SSPL-1.0"}
banned[pkg.licenses[_].license.id]
msg := sprintf("Banned license %s in %s", [pkg.licenses[_].license.id, pkg.name])
}
| Pitfall | Mitigation |
|---|---|
| SBOM generated but never queried | Push to Dependency-Track; alert on new CVEs |
| Signature optional | Make verification mandatory at admission |
| Renovate PR storm ignored | Group + schedule + auto-merge patches |
| License scan in legal silo | Shift left into CI with Conftest |
| Forgotten transitive deps | Scan full graph; fail on indirect critical CVEs |
SECURITY.md, THIRD_PARTY_LICENSES, Renovate config, policy bundle.Build production integrations with Anthropic Claude (Claude 4.5 Sonnet, Claude Opus 4, Claude Haiku 4) via the Messages API — system prompts, multi-turn conversations, tool use (function calling), prompt caching, extended thinking, vision, batched requests, and streaming. Use when wiring Claude into backends, agentic workflows, or evaluating it against other foundation models. Requires ANTHROPIC_API_KEY.
Deploy Cloudflare Workers, Pages, and Workers-with-static-assets safely using Wrangler 4.x with versioned uploads, gradual deployments, preview/production environments, secret bindings, observability, and one-command rollback. Use when shipping edge workloads, API routes, or full-stack apps to Cloudflare. Requires CLOUDFLARE_API_TOKEN with scoped permissions or an authenticated Wrangler session.
Deploy static sites, framework apps (Next.js, Astro, Remix, SvelteKit, Nuxt), Edge Functions, and serverless Functions to Netlify with deploy previews, branch deploys, atomic production promotion, scoped env vars, and instant rollback. Use when releasing on Netlify via CLI, API, or Git-triggered builds. Requires NETLIFY_AUTH_TOKEN (PAT) and NETLIFY_SITE_ID.
Transcribe audio with OpenAI speech-to-text models (gpt-4o-transcribe, gpt-4o-mini-transcribe, whisper-1) using prompt-guided terminology, segment-level timestamps, optional diarization via post-processing, and reliable artifact delivery. Use when converting interviews, calls, podcasts, or meeting recordings into reviewable text. Requires OPENAI_API_KEY.
Deploy Web Services, Private Services, Background Workers, Cron Jobs, Static Sites, PostgreSQL, and Key-Value (Redis-compatible) on Render via Blueprints (`render.yaml`) or the Render API with preview environments, zero-downtime rolling deploys, health checks, env-group secret scoping, and one-click rollback. Use when releasing services, applying schema migrations, or syncing infra-as-code on Render. Requires RENDER_API_KEY (owner- or workspace-scoped).
Operate Sentry end-to-end — error monitoring, performance tracing, session replay, profiling, release health, source-map upload, ownership routing, alert tuning, issue triage, and CI integration via sentry-cli — across web, mobile, and backend stacks. Use when instrumenting an app, wiring releases into deploy pipelines, or running incident-grade triage. Requires SENTRY_AUTH_TOKEN (org-scoped, `project:releases project:write`), project DSN, and (for source maps) `org` + `project` slugs.