supply-chain-security
作者： microsoft
軟體供應鏈安全參考，涵蓋 OpenSSF Scorecard、SLSA、Sigstore、SBOM 及態勢/待辦事項分類法。
npx skills add https://github.com/microsoft/hve-core --skill supply-chain-securitySupply Chain Security
This skill packages the durable software supply chain security (SSSC) reference material: open-standard catalogs, the combined capabilities inventory, and the classification taxonomies used to assess a repository's posture and turn gaps into prioritized work items.
When to use
Use this skill when you need to:
- Assess a repository against the 27 combined supply chain capabilities from hve-core and physical-ai-toolchain.
- Map posture against OpenSSF Scorecard, SLSA v1.0, OpenSSF Best Practices Badge, Sigstore (cosign), or NTIA SBOM minimum elements.
- Classify a gap by adoption category, effort size, or qualitative concern level.
- Derive work item priority and execution order from Scorecard risk levels.
Skill layout
Load the reference file for the topic you need. Each file holds the verbatim standard catalog or taxonomy.
| Reference | Topic |
|---|---|
| references/00-index.md | Navigation catalog for every reference in this skill |
| references/openssf-scorecard.md | OpenSSF Scorecard 20 checks with risk levels and score ranges |
| references/slsa-levels.md | SLSA v1.0 Build track levels L0 through L3 |
| references/best-practices-badge.md | OpenSSF Best Practices Badge Passing, Silver, and Gold criteria |
| references/sigstore-maturity.md | Sigstore (cosign) adoption maturity levels |
| references/sbom-elements.md | NTIA SBOM minimum elements and format guidance |
| references/capabilities-inventory.md | 27 combined capabilities across hve-core, PAT, and shared sets |
| references/adoption-categories.md | Six adoption categories, effort sizing, and concern levels |
| references/scorecard-check-mapping.md | Full 20-check implementation and adoption reference mapping |
| references/priority-derivation.md | Risk level to priority and execution order derivation |
Attribution
Standard catalogs in this skill derive from their respective upstream projects. Per-reference attribution appears at the bottom of each reference file. See references/00-index.md for the consolidated attribution summary.
來自 microsoft 的更多技能
oss-growth
microsoft
開源增長駭客角色
agent-framework-azure-ai-py
microsoft
使用Microsoft Agent Framework Python SDK（agent-framework-azure-ai）构建Azure AI Foundry代理。适用于使用AzureAIAgentsProvider创建持久化代理、使用托管工具（代码解释器、文件搜索、网络搜索）、集成MCP服务器、管理对话线程或实现流式响应。涵盖函数工具、结构化输出和多工具代理。
development
airunway-aks-setup
microsoft
在AKS上設定AI Runway——從裸叢集到執行模型。涵蓋叢集驗證、控制器安裝、GPU評估、供應商設定及首次部署。時機：「設定AI Runway」、「上線AKS叢集」、「安裝AI Runway」、「airunway設定」、「部署模型至AKS」、「在AKS上進行GPU推論」、「在AKS上設定KAITO」、「在AKS上執行LLM」、「在AKS上使用vLLM」、「在AKS上設定模型服務」、「AI Runway控制器」。
devops
appinsights-instrumentation
microsoft
使用Azure Application Insights檢測Web應用程式的指南。提供遙測模式、SDK設定與組態參考。適用時機：如何檢測應用程式、App Insights SDK、遙測模式、什麼是App Insights、Application Insights指南、檢測範例、APM最佳實踐。
devops
applicationinsights-web-ts
microsoft
使用Application Insights JavaScript SDK（@microsoft/applicationinsights-web）為瀏覽器/Web應用程式進行檢測。適用於真實使用者監控（RUM）——頁面檢視、點擊、AJAX/fetch依賴、例外、自訂事件，以及與後端OpenTelemetry追蹤關聯的瀏覽器端GenAI代理追蹤。涵蓋SDK載入器指令碼與npm設定、框架擴充（React、React Native、Angular）、點擊分析、遙測初始化器，以及從瀏覽器發出的代理/工具/模型span的OTel GenAI語意慣例。
devops
azure-ai-anomalydetector-java
microsoft
使用適用於 Java 的 Azure AI 異常偵測器 SDK 建置異常偵測應用程式。在實作單變量/多變量異常偵測、時間序列分析或 AI 驅動監控時使用。
development
azure-ai-language-conversations-py
microsoft
使用 azure-ai-language-conversations Python SDK 實作對話語言理解（CLU）。當使用 ConversationAnalysisClient 分析對話意圖與實體、建置 NLP 功能，或將語言理解整合至應用程式時使用。
development
azure-ai-ml-py
microsoft
Azure Machine Learning SDK v2 for Python。用於機器學習工作區、作業、模型、資料集、計算資源與管線。 觸發詞：「azure-ai-ml」、「MLClient」、「workspace」、「model registry」、「training jobs」、「datasets」。
development