From vanguard-frontier-agentic
Reviews Sigstore Cosign image signing, Kyverno imageVerify policies, SLSA/SBOM attestations, and Rekor transparency log posture for Kubernetes supply chain security.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:sigstore-cosign-supply-chain-reviewThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Review Cosign image signing verification, Kyverno imageVerify admission policy, SBOM and SLSA provenance attestations, Rekor transparency log posture, and keyless vs key-based signing configuration against supply chain integrity, SLSA level claims, and Kubernetes admission-time enforcement. Sigstore's security model depends entirely on the identity constraints baked into admission policy — an i...
Review Cosign image signing verification, Kyverno imageVerify admission policy, SBOM and SLSA provenance attestations, Rekor transparency log posture, and keyless vs key-based signing configuration against supply chain integrity, SLSA level claims, and Kubernetes admission-time enforcement. Sigstore's security model depends entirely on the identity constraints baked into admission policy — an imageVerify rule with no issuer or subject constraint is functionally equivalent to no verification at all.
cosign verify, kubectl get clusterpolicies, cosign verify-attestation) when the active client exposes it; otherwise fall back to official Sigstore documentation and sanitized YAML from the user.issuer and subject constraints as a critical finding — any Sigstore-signed image from any identity passes.exclude rules in imageVerify that match broad glob patterns (* or registry.io/*) as a high finding — third-party images bypass verification.slsa-verifier as a high finding.COSIGN_NO_TLOG=1 on non-private-Rekor setups as a medium finding — public transparency is disabled without a private transparency alternative.Load these only when needed:
Return, at minimum:
npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticSigns and verifies container image provenance using Sigstore Cosign with keyless OIDC signing, attestations, and Kubernetes admission enforcement.
Sign and verify container images with Sigstore Cosign using key-based or keyless OIDC signing, generate attestations, and enforce admission policies in Kubernetes.
Signs and verifies container image provenance using Sigstore Cosign with keyless OIDC signing, attestations, and Kubernetes admission enforcement.