supply-chain-trust

Decision-aid skill for supply-chain trust beyond CVE scanning and SBOM. Covers dependency pinning depth, reproducible builds, snapshot pinning, firmware version locking, and vendor+hash-lock for critical-path deps

Independent GitHub snapshot · Automated classification · Original documentation governs