{"id":"cmuxo6v5a2yc0ad07kmfy11zt","slug":"techtide-sigstore-cosign-supply-chain-review","publicId":"fa15f242-3364-4b74-a6db-972a77af88f6","name":"techtide-sigstore-cosign-supply-chain-review","description":"Use this skill when reviewing Sigstore Cosign supply chain security for Kubernetes workloads. Trigger when the user asks whether images are properly signed, whether Kyverno imageVerify policy is correctly scoped, whether SLSA provenance attestations exist, whether SBOM attestations are present, whether keyless signing is in use, or whether Rekor transparency log posture is appropriate for private images.","version":"0.1.0","author":"github: TechTide","license":"Apache-2.0","compatibility":"","status":"completed","overallGrade":"B","scannerVersion":11,"fileCount":3,"hasSkillMd":true,"hasScripts":false,"hasReferences":true,"hasEvals":false,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/techtideohio/techtide-harness-kit/tree/master/skills/sigstore/techtide-sigstore-cosign-supply-chain-review","createdAt":"2026-10-07T05:31:34.667Z","completedAt":"2026-10-07T05:31:34.665Z","visibility":"public","publishedAt":"2026-09-03T05:57:35.768Z","category":"","frameworks":[],"badgeStatus":"conditional","downloadCount":0,"verdictRationale":{"summary":"Skill has warnings: 1 warning in security or structure checks.","verdict":"warn","scanners":[{"source":"vettd","weight":1,"verdict":"warn"},{"source":"cisco","weight":0.8,"verdict":"pass"}],"consensus":"warn","warnTriggers":["References external URL — review for indirect prompt injection risk"],"policyVersion":"consensus-v1","hardFailTriggers":[]},"verdictPolicyVersion":"consensus-v1","skillId":"cmtl45cnh83rmad094vcgpm1e","findings":[{"id":"cmuxo6v5a2yc1ad07uuqrcstt","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/workflow-and-output.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"f8044f90f0516d4c0b6232561b0e9551","filepath":"references/workflow-and-output.md"},{"id":"cmuxo6v5a2yc2ad07c34kah4k","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"592f7ac7731768f0fd0bba83f30850f9","filepath":"SKILL.md"}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"A","findingCount":1,"criticalCount":0,"highCount":0},{"source":"vettd","status":"success","verdict":null,"grade":"B","findingCount":1,"criticalCount":0,"highCount":0}],"user":{"name":"Kris Mondlane","image":"https://avatars.githubusercontent.com/u/237055?v=4"},"repository":{"owner":"techtideohio","name":"techtide-harness-kit"},"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T07:44:15.804Z","lastVerifiedAt":"2026-10-21T07:44:15.804Z","lastChangeDetectedAt":null,"scannedHash":"5b49ce03205562e66bfd5472e67ef835d1d900cf","latestUpstreamHash":"5b49ce03205562e66bfd5472e67ef835d1d900cf","nextCheckDueAt":"2026-10-22T09:49:37.703Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":{"form":"measured","magnitudes":[{"ruleId":"performance/static-context-tokens","label":"Static context tokens","value":517,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body"}]},"rows":[{"origin":"signal","id":"cmuxo72392zflad07issutu15","subjectType":"skill_audit","subjectId":"cmuxo6v5a2yc0ad07kmfy11zt","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/progressive-disclosure","severity":null,"label":"Progressive disclosure","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T05:31:27.000Z","payload":null},{"origin":"signal","id":"cmuxo6wtp2ykmad07gke1hlrs","subjectType":"skill_audit","subjectId":"cmuxo6v5a2yc0ad07kmfy11zt","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/static-context-tokens","severity":null,"label":"Static context tokens","detail":null,"valueNum":517,"valueText":null,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body","derivation":null,"confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T05:31:27.000Z","payload":null}]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":{"form":"unjudged"},"rows":[{"origin":"signal","id":"cmuxo6x7w2ynead07ekah3zoo","subjectType":"skill_audit","subjectId":"cmuxo6v5a2yc0ad07kmfy11zt","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-environment-assumptions","severity":null,"label":"Declared environment assumptions","detail":null,"valueNum":null,"valueText":"","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T05:31:27.000Z","payload":null},{"origin":"signal","id":"cmuxo6zb12z2tad07fkbbc631","subjectType":"skill_audit","subjectId":"cmuxo6v5a2yc0ad07kmfy11zt","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-name","severity":null,"label":"Declared skill name","detail":null,"valueNum":null,"valueText":"techtide-sigstore-cosign-supply-chain-review","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T05:31:27.000Z","payload":null},{"origin":"signal","id":"cmuxo6y2f2ytkad07knjatuoj","subjectType":"skill_audit","subjectId":"cmuxo6v5a2yc0ad07kmfy11zt","relatedType":"declared_tool","relatedId":"Glob","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-required-tools","severity":null,"label":"Declared required tool","detail":null,"valueNum":null,"valueText":"Glob","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T05:31:27.000Z","payload":null},{"origin":"signal","id":"cmuxo6yb52yv9ad07c6ncp9x2","subjectType":"skill_audit","subjectId":"cmuxo6v5a2yc0ad07kmfy11zt","relatedType":"declared_tool","relatedId":"Grep","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-required-tools","severity":null,"label":"Declared required tool","detail":null,"valueNum":null,"valueText":"Grep","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T05:31:27.000Z","payload":null},{"origin":"signal","id":"cmuxo6ylj2yxfad0798059hka","subjectType":"skill_audit","subjectId":"cmuxo6v5a2yc0ad07kmfy11zt","relatedType":"declared_tool","relatedId":"Read","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-required-tools","severity":null,"label":"Declared required tool","detail":null,"valueNum":null,"valueText":"Read","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T05:31:27.000Z","payload":null}]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":28,"publisherSupplied":["name","description","author","version","license"]}