# Supply Chain Security

> Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies.

- **Type:** Skill
- **Install:** `agentstack add skill-microsoft-hve-core-supply-chain-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [microsoft](https://agentstack.voostack.com/s/microsoft)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [microsoft](https://github.com/microsoft)
- **Source:** https://github.com/microsoft/hve-core/tree/main/.github/skills/security/supply-chain-security

## Install

```sh
agentstack add skill-microsoft-hve-core-supply-chain-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Supply Chain Security

This skill packages the durable software supply chain security (SSSC) reference material: open-standard catalogs, the combined capabilities inventory, and the classification taxonomies used to assess a repository's posture and turn gaps into prioritized work items.

## When to use

Use this skill when you need to:

* Assess a repository against the 27 combined supply chain capabilities from hve-core and physical-ai-toolchain.
* Map posture against OpenSSF Scorecard, SLSA v1.0, OpenSSF Best Practices Badge, Sigstore (cosign), or NTIA SBOM minimum elements.
* Classify a gap by adoption category, effort size, or qualitative concern level.
* Derive work item priority and execution order from Scorecard risk levels.

## Skill layout

Load the reference file for the topic you need. Each file holds the verbatim standard catalog or taxonomy.

| Reference                                                                      | Topic                                                           |
|--------------------------------------------------------------------------------|-----------------------------------------------------------------|
| [references/00-index.md](references/00-index.md)                               | Navigation catalog for every reference in this skill            |
| [references/openssf-scorecard.md](references/openssf-scorecard.md)             | OpenSSF Scorecard 20 checks with risk levels and score ranges   |
| [references/slsa-levels.md](references/slsa-levels.md)                         | SLSA v1.0 Build track levels L0 through L3                      |
| [references/best-practices-badge.md](references/best-practices-badge.md)       | OpenSSF Best Practices Badge Passing, Silver, and Gold criteria |
| [references/sigstore-maturity.md](references/sigstore-maturity.md)             | Sigstore (cosign) adoption maturity levels                      |
| [references/sbom-elements.md](references/sbom-elements.md)                     | NTIA SBOM minimum elements and format guidance                  |
| [references/capabilities-inventory.md](references/capabilities-inventory.md)   | 27 combined capabilities across hve-core, PAT, and shared sets  |
| [references/adoption-categories.md](references/adoption-categories.md)         | Six adoption categories, effort sizing, and concern levels      |
| [references/scorecard-check-mapping.md](references/scorecard-check-mapping.md) | Full 20-check implementation and adoption reference mapping     |
| [references/priority-derivation.md](references/priority-derivation.md)         | Risk level to priority and execution order derivation           |

## Attribution

Standard catalogs in this skill derive from their respective upstream projects. Per-reference attribution appears at the bottom of each reference file. See [references/00-index.md](references/00-index.md) for the consolidated attribution summary.

> Brought to you by microsoft/hve-core

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [microsoft](https://github.com/microsoft)
- **Source:** [microsoft/hve-core](https://github.com/microsoft/hve-core)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-microsoft-hve-core-supply-chain-security
- Seller: https://agentstack.voostack.com/s/microsoft
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.