Generate Slsa

What it does

When your agent uses it

• Asked to generate SLSA
• Add SLSA provenance
• SLSA Generation step
• Configure SLSA Level 3 provenance in a pipeline

Example prompts

• “/generate-slsa”

Requirements

• Docker
• Compatibility (from SKILL.md): Requires Harness MCP v2 server (harness-mcp-v2)

Workflow steps

12 steps, taken from the first numbered list in SKILL.md.

1. 1One question per turn — use AskQuestion when available; otherwise numbered options with (Recommended).
2. 2Opening message — add SLSA Generation after image build/push; mention attestation options.
3. 3Progress breadcrumb — after pipeline fetch
4. 4Record answers — running summary; do not re-ask unless the user changes direction.
5. 5Fetch before configure — harness_get before placement/source questions.
6. 6Show pipeline structure — highlight build/push steps and existing provenance / SscaOrchestration steps (UI: SLSA Generation).
7. 7Infer connector from build/push — skip connector question when unambiguous from YAML.
8. 8Never guess image tags — always ask for image/repo in Phase 7.
9. 9Confirm before write — summary + harness_update only after user confirms.
10. 10Stop after update — after successful harness_update, provide a configuration summary and
11. 11Phase 3 Placement is mandatory — always run Phase 2 then Phase 3, even with one CI stage or prior session context.
12. 12Sequential with SBOM — if SscaOrchestration exists, place SLSA after it; never parallel (Cosign race).

What it can do on your machine

Read from SKILL.md and the folder at commit c25faee. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are yaml).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Requires Harness MCP v2 server (harness-mcp-v2)

  From compatibility in the SKILL.md frontmatter.

Context cost

Generate Slsa loads about 3k tokens when it runs, and up to ~6.5k if it reads all its reference files. Until then it costs about 178 tokens; SKILL.md has 1,009 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~178

When it runs · the whole SKILL.md, loaded when a task matches

~3k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~6.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from harness/harness-skills at commit c25faee, republished under its Apache-2.0 licence (© harness). 1,009 words, ~2,962 tokens.

name

generate-slsa

description

Add a SLSA Generation step (YAML type: provenance) to an existing Harness pipeline to generate SLSA provenance and optionally attest with Cosign (keyless, key-based, or Vault). Supports container images (Docker, ECR, GCR, GAR, ACR, HAR) and Harness Local Stage artifacts. Place after image build/push; run sequentially after SBOM steps, not in parallel. Only works with existing pipelines. Use when asked to generate SLSA, add SLSA provenance, SLSA Generation step, attest SLSA, or configure SLSA Level 3 provenance in a pipeline. Trigger phrases: generate SLSA, SLSA generation, add SLSA step, SLSA provenance, attest SLSA, SlsaGeneration, provenance step, SLSA attestation, add provenance step.

compatibility

Requires Harness MCP v2 server (harness-mcp-v2)

metadata.author

Harness

metadata.version

1.0.0

metadata.mcp-server

harness-mcp-v2

license

Apache-2.0

- step:
    identifier: slsageneration
    name: slsa-generation
    type: provenance
    spec:
      source:
        type: docker
        spec:
          connector: lavakush07
          repo: lavakush07/easy-buggy-app:blog
      attestation:
        type: keybased
        spec:
          privateKey: account.cosign_private_key
          password: account.cosign_password
    timeout: 15m

      attestation:
        type: keyless
        spec:
          oidcProvider: harness

      source:
        type: docker
        spec:
          connector: <docker_registry_connector>
          repo: <org>/<repo>:<tag>
          digest: <+pipeline.stages.<stage>.spec.execution.steps.<build_step>.output.outputVariables.digest>

      source:
        type: ecr
        spec:
          connector: <registry_connector>
          image: <repo/name>
          region: <aws_region>
          account: <aws_account_id>

harness_update
  resource_type: pipeline
  resource_id: <pipeline_identifier>
  org_id: <organization>
  project_id: <project>
  body: { yamlPipeline: "<updated pipeline YAML>" }

## SLSA Generation Configured

**Pipeline:** <pipeline_name>
**Step:** SLSA Generation (`provenance`)
**Location:** Stage "<stage_name>", <position>
**Source:** docker — <connector> — <repo/image>
**Attestation:** Key-based (account.cosign_private_key) — or as configured

**Pipeline URL:** https://app.harness.io/ng/account/<account_id>/module/ci/orgs/<org_id>/projects/<project_id>/pipelines/<pipeline_id>/pipeline-studio/

**Note:** Review the SLSA Generation step in Pipeline Studio to adjust Advanced settings.

**Provenance:** After a successful run, view on the Supply Chain tab and in SCS Artifacts.

### Next Steps
1. Run the pipeline via `/run-pipeline` to verify the SLSA Generation step executes successfully
2. If the run fails, diagnose with `/debug-pipeline`
3. Add SLSA verification with `/enforce-slsa`
4. Pair with `SscaOrchestration` (Generate SBOM) — run SBOM then SLSA sequentially
5. Automate with `/create-trigger`

/generate-slsa
Add SLSA Generation to my CI pipeline after docker push — lavakush07/easy-buggy-app:blog, key-based attest with account cosign secrets

/generate-slsa
Use defaults — keyless Harness OIDC after Build_and_Push step

/generate-slsa
Generate SLSA for image from Build_and_Push digest output — keyless attest

/generate-slsa
add slsa to the pipeline

© harness, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (references) in skills/generate-slsa of harness/harness-skills.

• SKILL.md
• references/cd-containerized-step-group.md
• references/interactive-wizard-flow.md
• references/slsa-generation-step.md

Open the folder on GitHubat commit c25faee