Supply Chain Security Skill

SolarWinds, Log4Shell, XZ-Utils — modern attacks compromise the build pipeline and dependencies, not just the running service. This skill covers protecting the full software supply chain from source code to deployment.

When to Activate

• Generating or updating an SBOM (Software Bill of Materials)
• Setting up artifact signing for container images or releases
• Auditing dependency pinning practices
• Achieving SLSA compliance for a project
• Responding to a CVE in a dependency
• Configuring CI/CD for supply chain security

SBOM — Software Bill of Materials

An SBOM is a machine-readable inventory of every component in your software. Think of it as a manifest for your software's ingredients.