Devsecops Supply Chain

DevSecOps Supply Chain Security

When to Use

• Setting up dependency security for a new project
• Generating SBOM for compliance or audit
• Investigating a suspicious dependency
• Responding to a supply chain incident
• Configuring CI/CD security gates

SBOM Generation

Formats

| Format | Standard | Best For | |--------|----------|---------| | CycloneDX | OWASP | Security-focused, VEX support | | SPDX | Linux Foundation | License compliance, legal |

Generation Commands

If a terminal is available, use these commands. Otherwise, describe what fields to include manually.

Node.js/npm:

npx @cyclonedx/cyclonedx-npm --output-file sbom.json

Python/pip:

pip install cyclonedx-bom
cyclonedx-py requirements -i requirements.txt -o sbom.json

Go:

cyclonedx-gomod mod -json -output sbom.json

SLSA Compliance Levels

| Level | Requirement | How | |-------|-------------|-----| | SLSA 1 | Documentation of build process | Document build steps | | SLSA 2 | Hosted build platform, signed provenance | Use GitHub Actions, sign with Sigstore | | SLSA 3 | Hardened build platform, non-falsifiable provenance | Isolated builders, hermetic builds |

Supply Chain Attack Patterns

| Pattern | Detection | Prevention | |---------|-----------|------------| | Typosquatting | Compare package name to known packages | Pin exact versions | | Dependency confusion | Check if internal name exists on public registry | Scope packages, configure registry priority | | Compromised maintainer | Monitor for unusual releases, new maintainers | Pin versions + hashes, delayed adoption | | Malicious post-install | Audit install scripts | --ignore-scripts flag, review before install | | Star-jacking | Verify GitHub URL matches npm/PyPI metadata | Cross-reference package metadata |

Dependency Audit Checklist

1. Are all dependencies pinned to exact versions?
2. Are lockfiles committed and reviewed in PRs?
3. Are dependency hashes verified (pip --require-hashes, npm --package-lock-only)?
4. Is there a delay before adopting new package versions (7+ days)?
5. Are transitive dependencies audited (not just direct)?
6. Are install scripts reviewed for new dependencies?
7. Is there automated vulnerability scanning in CI?

What This Skill Does NOT Do

• Does not patch vulnerabilities automatically
• Does not detect zero-day exploits
• Does not replace tools like Snyk, Dependabot, or pip-audit (complements them)
• Does not manage secrets rotation

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: BuilderCed
• Source: BuilderCed/agent-skills
• License: MIT
• Homepage: https://skills.sh/BuilderCed/agent-skills

Install and usage instructions live in the source repository linked above.