Supply Chain Security

Download SKILL.mdGet Murage How skills work

Open source. macOS, Windows and Linux.

At a glance

What it is

Software supply chain security expertise covering SBOM generation and analysis, dependency vulnerability scanning, Sigstore signing and verification, SLSA framework compliance, artifact provenance, build integrity, package manager security, container image signing, and CI/CD pipeline hardening for establishing trust in the software delivery process.

A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.

File: SKILL.md
Length: 366 lines1,477 words, about 7 min read
Category: Securitysupply chain security
Level: Intermediate
License

Teams that use this skill.

Dev ShopFrom a clear spec to reviewed code and a release ready for your approvalA team of 6 bots

Each of these library teams gives its bots this skill. Import one and look inside first.

More security skills.

The full skill.

The whole file, exactly as it downloads. Read it before you rely on it.

SKILL.md

366 lines · 1,477 words

Download

Supply Chain Security

You are a software supply chain security specialist focused on establishing trust and integrity throughout the software delivery pipeline. You help teams generate and analyze SBOMs, sign and verify artifacts, achieve SLSA compliance levels, and implement comprehensive dependency scanning to prevent supply chain attacks.

Threat Landscape

Attack Vectors

1. Dependency Confusion: Public package supersedes internal package name
2. Typosquatting: Malicious package with similar name to popular one
3. Compromised Maintainer: Attacker gains access to legitimate account
4. Build System Compromise: CI/CD tampered to inject malicious code
5. Malicious Contribution: Subtle backdoor via pull request
6. Abandoned Package Takeover: Attacker claims orphaned package

Put this skill to work.

Questions.

What is the Supply Chain Security skill?

How much does it cost?

Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.

Can I change it?

Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.

Give your first job to Murage.

Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.

Download Murage

No account needed · Runs on the AI plan you already pay for

1. Dependency Confusion: Public package supersedes internal package name 2. Typosquatting: Malicious package with similar name to popular one 3. Compromised Maintainer: Attacker gains access to legitimate account 4. Build System Compromise: CI/CD tampered to inject malicious code 5. Malicious Contribution: Subtle backdoor via pull request 6. Abandoned Package Takeover: Attacker claims orphaned package

Attack Vector	Likelihood	Impact	Priority
Dependency confusion	High	Critical	Immediate
Known vulns in deps	High	High	Immediate
Typosquatting	Medium	High	High
Compromised maintainer	Low	Critical	High
Build system compromise	Low	Critical	High

Supply Chain Security

Teams that use this skill.

More security skills.

The full skill.

Supply Chain Security

Threat Landscape

Attack Vectors

Put this skill to work.

Questions.

Give your first job to Murage.

Search murage.ai

Supply Chain Security

Teams that use this skill.

More security skills.

The full skill.

Supply Chain Security

Threat Landscape

Attack Vectors

Put this skill to work.

Questions.

Give your first job to Murage.

Create a bot and use this skill.

Ask Ember to create the bot

Open the bot’s skills

Find Supply Chain Security and switch it on

Ask the bot for the job

About this skill.

Risk Assessment

SBOM Generation

Generation Tooling

SBOM Comparison for Change Detection

Dependency Scanning

Multi-Ecosystem Scanning

Vulnerability Policy

Dependency Pinning Checklist

Sigstore and Artifact Signing

Signing with Cosign

Sigstore Components

SLSA Framework

SLSA Levels

Achieving SLSA Level 2 with GitHub Actions

Provenance Verification

CI/CD Pipeline Hardening

Pipeline Security Checklist

Dependency Confusion Prevention

Maturity Model

When to Use

Output Format

Example

Edge Cases