GitHub Actions Supply Chain Pinning
asyncapi/generator
A skill your agent uses when editing, adding, or reviewing any file under .github/workflows/, or when a CI step installs a CLI tool (npm i -g, npx, pipx, uses: /setup-).
Agent skill
Verifying Build Provenance With Slsa Sigstore
Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder…
Install Verifying Build Provenance With Slsa Sigstore
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill verifying-build-provenance-with-slsa-sigstore -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills verifying-build-provenance-with-slsa-sigstore --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/verifying-build-provenance-with-slsa-sigstore .claude/skills/verifying-build-provenance-with-slsa-sigstore && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "verifying-build-provenance-with-slsa-sigstore" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/verifying-build-provenance-with-slsa-sigstore into .claude/skills/verifying-build-provenance-with-slsa-sigstore/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "verifying-build-provenance-with-slsa-sigstore", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/verifying-build-provenance-with-slsa-sigstoreType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill verifying-build-provenance-with-slsa-sigstore -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills verifying-build-provenance-with-slsa-sigstore --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/verifying-build-provenance-with-slsa-sigstore .agents/skills/verifying-build-provenance-with-slsa-sigstore && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "verifying-build-provenance-with-slsa-sigstore" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/verifying-build-provenance-with-slsa-sigstore into .agents/skills/verifying-build-provenance-with-slsa-sigstore/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "verifying-build-provenance-with-slsa-sigstore", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill verifying-build-provenance-with-slsa-sigstore -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills verifying-build-provenance-with-slsa-sigstore --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/verifying-build-provenance-with-slsa-sigstore .cursor/skills/verifying-build-provenance-with-slsa-sigstore && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "verifying-build-provenance-with-slsa-sigstore" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/verifying-build-provenance-with-slsa-sigstore into .cursor/skills/verifying-build-provenance-with-slsa-sigstore/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "verifying-build-provenance-with-slsa-sigstore", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/verifying-build-provenance-with-slsa-sigstore--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill verifying-build-provenance-with-slsa-sigstore -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills verifying-build-provenance-with-slsa-sigstore --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/verifying-build-provenance-with-slsa-sigstore .gemini/skills/verifying-build-provenance-with-slsa-sigstore && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "verifying-build-provenance-with-slsa-sigstore" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/verifying-build-provenance-with-slsa-sigstore into .gemini/skills/verifying-build-provenance-with-slsa-sigstore/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "verifying-build-provenance-with-slsa-sigstore", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills verifying-build-provenance-with-slsa-sigstoreInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill verifying-build-provenance-with-slsa-sigstore -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/verifying-build-provenance-with-slsa-sigstore .github/skills/verifying-build-provenance-with-slsa-sigstore && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "verifying-build-provenance-with-slsa-sigstore" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/verifying-build-provenance-with-slsa-sigstore into .github/skills/verifying-build-provenance-with-slsa-sigstore/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "verifying-build-provenance-with-slsa-sigstore", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill verifying-build-provenance-with-slsa-sigstore -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills verifying-build-provenance-with-slsa-sigstore --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/verifying-build-provenance-with-slsa-sigstore .opencode/skills/verifying-build-provenance-with-slsa-sigstore && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "verifying-build-provenance-with-slsa-sigstore" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/verifying-build-provenance-with-slsa-sigstore into .opencode/skills/verifying-build-provenance-with-slsa-sigstore/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "verifying-build-provenance-with-slsa-sigstore", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
verifying-build-provenance-with-slsa-sigstore- GitHub stars
- 34k
- Token cost
- ~2.7k tokens
- SKILL.md length
- 824 words
- Files
- 5 (incl. scripts, references)
- Skills in repo
- 644
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder…
- Works in 7 steps: Verify a keyless cosign signature on an… → Verify the SLSA provenance attestation… → Inspect the provenance predicate → …
- Tasks that involve Supply chain security
- SKILL.md covers Overview, When to Use, Prerequisites and Objectives, plus 5 more sections
- Runs Python scripts from its folder; calls go, jq and curl; reaches github.com and token.actions.githubusercontent.com
What it does
Verifying Build Provenance With Slsa Sigstore is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI/CD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.
Its SKILL.md is about 2.7k tokens, which your agent loads only when the skill is triggered. The skill folder holds 6 other files, including scripts and reference files (for example `references/api-reference.md`, `references/standards.md` and `scripts/agent.py`).
It sits in DevOps & Cloud, covering Supply chain security. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.
When your agent uses it
- Tasks that involve Supply chain security
Example prompts
- “Use the verifying-build-provenance-with-slsa-sigstore skill to verify artifact signatures and SLSA provenance using Sigstore's cosign (verify…”
- “/verifying-build-provenance-with-slsa-sigstore”
Requirements
- Python 3
Workflow steps
7 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/ (Python), which the agent can run.
Shell commands in SKILL.md call:
gojqcurlgh
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
github.comtoken.actions.githubusercontent.comrekor.sigstore.dev
Also links to:
slsa.devsigstore.devdocs.sigstore.dev
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Verifying Build Provenance With Slsa Sigstore loads about 2.7k tokens when it runs, and up to ~3.6k if it reads all its reference files. Until then it costs about 121 tokens; SKILL.md has 824 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 824 words, ~2,659 tokens.
Download SKILL.mdSave it as
.claude/skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.- name
- verifying-build-provenance-with-slsa-sigstore
- description
- Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI/CD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.
- domain
- cybersecurity
- subdomain
- supply-chain-security
- tags
- supply-chain, slsa, sigstore, cosign, provenance, attestation, keyless-signing, code-signing
- version
- 1.0
- author
- mahipal
- license
- Apache-2.0
- nist_csf
- PR.DS-01
- mitre_attack
- T1195
Verifying Build Provenance with SLSA and Sigstore
Overview
Build-provenance verification answers a question that defeats many supply-chain attacks: was this artifact actually built from the source I think it was, by the builder I trust, without tampering? Attackers who compromise a build system, swap a compiled release, or inject a malicious step (as in the SolarWinds and 3CX incidents) produce artifacts that look legitimate but lack verifiable provenance. SLSA (Supply-chain Levels for Software Artifacts, https://slsa.dev) defines Build levels (L1–L3) describing increasing provenance integrity, and Sigstore (https://www.sigstore.dev) provides the signing and transparency infrastructure: cosign for signing/verifying artifacts and attestations, Fulcio for short-lived keyless certificates bound to an OIDC identity, and Rekor as a tamper-evident transparency log.
This skill covers verifying signatures and SLSA provenance with cosign (cosign verify, cosign verify-attestation, cosign verify-blob-attestation) and slsa-verifier (slsa-verifier verify-artifact), enforcing the builder identity (the GitHub Actions workflow that produced the artifact) and the expected source repository. Keyless verification ties trust to an OIDC issuer (e.g., https://token.actions.githubusercontent.com) and a certificate identity rather than a long-lived private key.
This maps to MITRE ATT&CK T1195 — Supply Chain Compromise (provenance verification detects/blocks tampered artifacts) and NIST CSF PR.DS-01 (the confidentiality, integrity, and availability of data-at-rest are protected; CSF 2.0 absorbed the retired 1.1 PR.DS-06 integrity-checking outcome here).
When to Use
- In CI/CD before deploying or promoting any container image or release binary.
- When consuming third-party artifacts (base images, Go/npm releases) that publish attestations.
- When establishing a SLSA Build L3 producer pipeline and enforcing it at the consumer side.
- During incident response to confirm whether a deployed artifact's provenance is intact.
- In admission control (e.g., Kubernetes via policy-controller / Kyverno) to admit only verified images.
Prerequisites
- cosign (Sigstore CLI):
bash go install github.com/sigstore/cosign/v2/cmd/cosign@latest # or download a release binary from https://github.com/sigstore/cosign/releases - slsa-verifier:
bash go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@latest # or: curl -sSL https://github.com/slsa-framework/slsa-verifier/releases/latest/download/slsa-verifier-linux-amd64 \ -o /usr/local/bin/slsa-verifier && chmod +x /usr/local/bin/slsa-verifier - Network access to Rekor (
https://rekor.sigstore.dev) and Fulcio for transparency-log verification. - The artifact plus its provenance/attestation bundle (
.sigstore,.intoto.jsonl, or attached OCI attestation).
Objectives
- Verify a keyless cosign signature on a container image, pinning OIDC issuer and certificate identity.
- Verify a SLSA provenance attestation on an image with
cosign verify-attestation --type slsaprovenance. - Verify a release binary's provenance with
slsa-verifier verify-artifact, pinning source repo and tag. - Verify GitHub artifact attestations / blob bundles with
cosign verify-blob-attestation. - Gate CI and admission control on successful verification; understand SLSA Build L1–L3.
MITRE ATT&CK Mapping
| ID | Tactic | Technique Name | Relevance |
|---|---|---|---|
| T1195 | Initial Access | Supply Chain Compromise | Verifying provenance and signatures detects artifacts that were tampered with or substituted in the build/distribution chain, preventing supply-chain compromise from reaching deployment. |
Workflow
Step 1: Verify a keyless cosign signature on an image
Pin both the OIDC issuer and the certificate identity (the exact workflow that signed). A bare cosign verify without identity pinning is meaningless — anyone can sign.
cosign verify \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
--certificate-identity-regexp "^https://github.com/myorg/myrepo/.github/workflows/.*@refs/tags/v.*" \
ghcr.io/myorg/myrepo:v1.2.3A non-zero exit or empty result means verification failed — do not deploy.
Step 2: Verify the SLSA provenance attestation on the image
The signature proves who signed; the provenance attestation proves how it was built. Verify the in-toto SLSA predicate type.
cosign verify-attestation \
--type slsaprovenance \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
--certificate-identity "https://github.com/myorg/myrepo/.github/workflows/build-sign.yml@refs/heads/main" \
ghcr.io/myorg/myrepo:v1.2.3Supported predicate types include slsaprovenance, slsaprovenance02, and slsaprovenance1.
Show full SKILL.md (337 more words)Show less
Step 3: Inspect the provenance predicate
Decode the verified attestation to confirm the source repo, commit, and builder match expectations.
cosign verify-attestation --type slsaprovenance \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
--certificate-identity-regexp '.*' \
ghcr.io/myorg/myrepo:v1.2.3 \
| jq -r '.payload' | base64 -d | jq '.predicate.buildDefinition.externalParameters, .predicate.runDetails.builder.id'Step 4: Verify a release binary with slsa-verifier
For downloadable binaries (e.g., produced by slsa-github-generator), pin the source URI and the tag. slsa-verifier checks the cryptographic signature on the provenance and that the expected builder produced it.
slsa-verifier verify-artifact slsa-test-linux-amd64 \
--provenance-path slsa-test-linux-amd64.intoto.jsonl \
--source-uri github.com/myorg/myrepo \
--source-tag v1.2.3
# Optionally pin the builder identity (SLSA L3)
slsa-verifier verify-artifact ./mybin \
--provenance-path ./mybin.intoto.jsonl \
--source-uri github.com/myorg/myrepo \
--builder-id https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v2.0.0Step 5: Verify GitHub artifact attestations / blob bundles
For artifacts signed via actions/attest-build-provenance, the bundle uses the new Sigstore bundle format.
cosign verify-blob-attestation \
--bundle ./myartifact.sigstore.json \
--new-bundle-format \
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
--certificate-identity-regexp="^https://github.com/myorg/myrepo/" \
./myartifact
# Equivalent native GitHub CLI verification
gh attestation verify ./myartifact --repo myorg/myrepoStep 6: Enforce verification as a gate
Wrap verification so the pipeline fails closed on any error.
#!/usr/bin/env bash
set -euo pipefail
IMG="ghcr.io/myorg/myrepo:v1.2.3"
cosign verify \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
--certificate-identity-regexp "^https://github.com/myorg/myrepo/" "$IMG" >/dev/null
cosign verify-attestation --type slsaprovenance \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
--certificate-identity-regexp "^https://github.com/myorg/myrepo/" "$IMG" >/dev/null
echo "[+] $IMG verified: signature + SLSA provenance OK"Step 7: Map findings to SLSA Build levels
Document the level each consumed artifact achieves:
- Build L1 — provenance exists (the build process generates it), but it may be unsigned/forgeable.
- Build L2 — provenance is signed by a hosted build service.
- Build L3 — provenance is non-forgeable: generated on an isolated, hardened builder where secrets are unavailable to user-defined steps (e.g.,
slsa-github-generatorreusable workflows). Require L3 for high-trust artifacts.
Tools and Resources
| Tool / Resource | Purpose | Link |
|---|---|---|
| cosign | Sign/verify artifacts and attestations (keyless) | https://github.com/sigstore/cosign |
| slsa-verifier | Verify SLSA provenance from compliant builders | https://github.com/slsa-framework/slsa-verifier |
| slsa-github-generator | Produce SLSA L3 provenance in GitHub Actions | https://github.com/slsa-framework/slsa-github-generator |
| actions/attest-build-provenance | GitHub-native provenance attestation | https://github.com/actions/attest-build-provenance |
| SLSA specification | Build levels and provenance schema | https://slsa.dev/spec/v1.0/ |
| Sigstore docs | Fulcio, Rekor, cosign verification | https://docs.sigstore.dev/cosign/verifying/verify/ |
Verification Identity Reference
| Field | Where it comes from | Why it matters |
|---|---|---|
--certificate-oidc-issuer | The OIDC issuer (e.g., GitHub Actions) | Restricts who could have requested the signing cert |
--certificate-identity[-regexp] | The exact/patterned workflow identity (SAN) | Restricts which workflow signed; prevents impersonation |
--source-uri (slsa-verifier) | Expected source repo | Confirms the artifact came from your repo |
--source-tag / --source-versioned-tag | Expected git tag | Prevents rollback/substitution |
--builder-id | Trusted builder workflow ref | Enforces SLSA L3 non-forgeable builder |
Validation Criteria
- cosign and slsa-verifier installed and report versions
- Image signature verified with pinned OIDC issuer AND certificate identity
- SLSA provenance attestation verified (
--type slsaprovenance) - Provenance predicate inspected; source repo/commit/builder match
- Release binary verified with slsa-verifier (source-uri + tag pinned)
- GitHub blob/bundle attestation verified
- Verification wired as a fail-closed CI/admission gate
- Each consumed artifact assigned a SLSA Build level
© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 4 other files (scripts, references) in skills/verifying-build-provenance-with-slsa-sigstore of mukul975/Anthropic-Cybersecurity-Skills.
- SKILL.md
- LICENSE
- references/api-reference.md
- references/standards.md
- scripts/agent.py
Open the folder on GitHubat commit 54a7988
Compare with similar skills
Verifying Build Provenance With Slsa Sigstore next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Verifying Build Provenance With Slsa Sigstore this skillmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.7k | Automated safety check: Pass | Apache-2.0 | |
| GitHub Actions Supply Chain Pinningasyncapi/generator | 1.1k | — | ~1.9k | Automated safety check: Pass | Apache-2.0 | |
| Vibe CI Supply Chainmistralai/mistral-vibe | 5.1k | — | ~1k | Automated safety check: Pass | Apache-2.0 | |
| Container Sbomcdxgen/cdxgen | 1.1k | — | ~1.5k | Automated safety check: Pass | Apache-2.0 | |
| CI/CD Pipeline Principlesirahardianto/awesome-agv | 156 | — | ~2.7k | Automated safety check: Notes | MIT | |
| Atmos CIcloudposse/atmos | 1.4k | — | ~4.7k | Automated safety check: Pass | Apache-2.0 |
Similar skills
- Official
Vibe CI Supply Chain
mistralai/mistral-vibe
Git workflow, CI/GitHub Actions, and supply-chain pinning rules for Mistral Vibe.
Container Sbom
cdxgen/cdxgen
Generates CycloneDX BOMs for container images, OCI archives, mounted root filesystems, Electron ASAR archives, caxa executables, binaries, and Kubernetes or Dockerfile manifests using OWASP cdxgen…
CI/CD Pipeline Principles
irahardianto/awesome-agv
Rules for designing CI/CD pipelines in layers: universal lint, test and scan stages, container builds with SBOM attestation, and GitOps for orchestrated deployments.
Atmos CI
cloudposse/atmos
Atmos CI: Native CI with GitHub Actions containers, native outputs, SBOM workflow-artifact publication, collapsible log groups, affected/all matrix workflows, OIDC profiles, toolchain-aware jobs…
Signed Audit Trails Recipe
wshobson/agents
Step-by-step cookbook for setting up cryptographically signed audit trails on Claude Code tool calls.
More from mukul975/Anthropic-Cybersecurity-Skills
All 644 skills in this repoCampaign Attribution Evidence Analysis
mukul975/Anthropic-Cybersecurity-Skills
Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.
Go Malware Analysis in Ghidra
mukul975/Anthropic-Cybersecurity-Skills
Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.
LNK and Jump List Forensics
mukul975/Anthropic-Cybersecurity-Skills
Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.
Malware Persistence Analysis with Autoruns
mukul975/Anthropic-Cybersecurity-Skills
Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.
NTFS MFT Deleted File Recovery
mukul975/Anthropic-Cybersecurity-Skills
Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.
Network Covert Channel Analysis
mukul975/Anthropic-Cybersecurity-Skills
Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.
Related
Categories
Questions about Verifying Build Provenance With Slsa Sigstore
What does Verifying Build Provenance With Slsa Sigstore do?
Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder…. Verifying Build Provenance With Slsa Sigstore is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels.
When should I use Verifying Build Provenance With Slsa Sigstore?
Verifying Build Provenance With Slsa Sigstore fits situations like: tasks that involve Supply chain security.
How do I install Verifying Build Provenance With Slsa Sigstore in Claude Code?
Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill verifying-build-provenance-with-slsa-sigstore -a claude-code`. Or copy the skill folder (skills/verifying-build-provenance-with-slsa-sigstore in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/verifying-build-provenance-with-slsa-sigstore in your project. Claude Code loads it when a task matches its description.
How do I install Verifying Build Provenance With Slsa Sigstore in Codex?
Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill verifying-build-provenance-with-slsa-sigstore -a codex`. Or copy the skill folder (skills/verifying-build-provenance-with-slsa-sigstore in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/verifying-build-provenance-with-slsa-sigstore in your project. Codex loads it when a task matches its description.
Can I use Verifying Build Provenance With Slsa Sigstore in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill verifying-build-provenance-with-slsa-sigstore -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/verifying-build-provenance-with-slsa-sigstore, .gemini/skills/verifying-build-provenance-with-slsa-sigstore, .github/skills/verifying-build-provenance-with-slsa-sigstore and .opencode/skills/verifying-build-provenance-with-slsa-sigstore in your project.
What does Verifying Build Provenance With Slsa Sigstore need to run?
Going by SKILL.md and its folder, Verifying Build Provenance With Slsa Sigstore needs Python for the scripts in its folder and the command-line tools its instructions call (go, jq, curl and gh). Our summary lists: Python 3.
Does Verifying Build Provenance With Slsa Sigstore access the network?
SKILL.md names 6 domains. In commands or code: github.com, token.actions.githubusercontent.com and rekor.sigstore.dev; the agent is likely to contact these when it follows the instructions. As links in the text: slsa.dev, sigstore.dev and docs.sigstore.dev. This is read from the text; nothing was executed.
Is Verifying Build Provenance With Slsa Sigstore safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Verifying Build Provenance With Slsa Sigstore use?
Verifying Build Provenance With Slsa Sigstore is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Verifying Build Provenance With Slsa Sigstore use?
About 2.7k tokens (SKILL.md is roughly 11k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 970 tokens, read only when the agent opens those files.
What are the alternatives to Verifying Build Provenance With Slsa Sigstore?
Skills that share tags, products or a category with Verifying Build Provenance With Slsa Sigstore: GitHub Actions Supply Chain Pinning (asyncapi/generator, 1.1k stars), Vibe CI Supply Chain (mistralai/mistral-vibe, 5.1k stars), Container Sbom (cdxgen/cdxgen, 1.1k stars) and CI/CD Pipeline Principles (irahardianto/awesome-agv, 156 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Verifying Build Provenance With Slsa Sigstore?
mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.
Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.