supply-chain-security

作者： microsoft

OpenSSF Scorecard、SLSA、Sigstore、SBOM以及态势/积压分类法的软件供应链安全参考。

npx skills add https://github.com/microsoft/hve-core --skill supply-chain-security

下载 ZIP GitHub

Supply Chain Security

This skill packages the durable software supply chain security (SSSC) reference material: open-standard catalogs, the combined capabilities inventory, and the classification taxonomies used to assess a repository's posture and turn gaps into prioritized work items.

When to use

Use this skill when you need to:

Assess a repository against the 27 combined supply chain capabilities from hve-core and physical-ai-toolchain.
Map posture against OpenSSF Scorecard, SLSA v1.0, OpenSSF Best Practices Badge, Sigstore (cosign), or NTIA SBOM minimum elements.
Classify a gap by adoption category, effort size, or qualitative concern level.
Derive work item priority and execution order from Scorecard risk levels.

Skill layout

Load the reference file for the topic you need. Each file holds the verbatim standard catalog or taxonomy.

Reference	Topic
references/00-index.md	Navigation catalog for every reference in this skill
references/openssf-scorecard.md	OpenSSF Scorecard 20 checks with risk levels and score ranges
references/slsa-levels.md	SLSA v1.0 Build track levels L0 through L3
references/best-practices-badge.md	OpenSSF Best Practices Badge Passing, Silver, and Gold criteria
references/sigstore-maturity.md	Sigstore (cosign) adoption maturity levels
references/sbom-elements.md	NTIA SBOM minimum elements and format guidance
references/capabilities-inventory.md	27 combined capabilities across hve-core, PAT, and shared sets
references/adoption-categories.md	Six adoption categories, effort sizing, and concern levels
references/scorecard-check-mapping.md	Full 20-check implementation and adoption reference mapping
references/priority-derivation.md	Risk level to priority and execution order derivation

Attribution

Standard catalogs in this skill derive from their respective upstream projects. Per-reference attribution appears at the bottom of each reference file. See references/00-index.md for the consolidated attribution summary.

来自 microsoft 的更多技能

OSS增长黑客角色

agent-framework-azure-ai-py

使用Microsoft Agent Framework Python SDK（agent-framework-azure-ai）构建Azure AI Foundry代理。在创建使用AzureAIAgentsProvider的持久化代理、使用托管工具（代码解释器、文件搜索、网络搜索）、集成MCP服务器、管理对话线程或实现流式响应时使用。涵盖函数工具、结构化输出和多工具代理。

airunway-aks-setup

在AKS上设置AI Runway——从裸集群到运行模型。涵盖集群验证、控制器安装、GPU评估、提供商设置和首次部署。适用场景：“设置AI Runway”、“接入AKS集群”、“安装AI Runway”、“airunway设置”、“将模型部署到AKS”、“在AKS上进行GPU推理”、“在AKS上配置KAITO”、“在AKS上运行LLM”、“在AKS上使用vLLM”、“在AKS上设置模型服务”、“AI Runway控制器”。

appinsights-instrumentation

使用Azure Application Insights对Web应用进行插桩的指南。提供遥测模式、SDK设置和配置参考。适用场景：如何对应用进行插桩、App Insights SDK、遥测模式、什么是App Insights、Application Insights指南、插桩示例、APM最佳实践。

applicationinsights-web-ts

使用Application Insights JavaScript SDK（@microsoft/applicationinsights-web）为浏览器/Web应用添加检测。用于真实用户监控（RUM）——页面视图、点击、AJAX/fetch依赖项、异常、自定义事件，以及与后端OpenTelemetry追踪关联的浏览器端GenAI代理追踪。涵盖SDK加载器脚本和npm设置、框架扩展（React、React Native、Angular）、点击分析、遥测初始化器，以及从浏览器发出的代理/工具/模型跨度所遵循的OTel GenAI语义约定。

azure-ai-anomalydetector-java

使用适用于 Java 的 Azure AI 异常检测器 SDK 构建异常检测应用程序。在实现单变量/多变量异常检测、时间序列分析或 AI 驱动的监控时使用。

azure-ai-language-conversations-py

使用azure-ai-language-conversations Python SDK实现对话语言理解（CLU）。当使用ConversationAnalysisClient分析对话意图和实体、构建NLP功能或将语言理解集成到应用程序中时使用。

Azure Machine Learning SDK v2 for Python。用于机器学习工作区、作业、模型、数据集、计算资源和管道。触发词：“azure-ai-ml”、“MLClient”、“工作区”、“模型注册表”、“训练作业”、“数据集”。