# Supply Chain Hygiene

> Supply Chain Hygiene is an Agent Skill for devops & security published in the kubernetes-sigs/kueue repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Flag supply-chain hygiene gaps — unpinned image refs, TLS bypass, unjustified go.mod replace directives, curl|sh, moving-tag GitHub Actions (CWE-295, CWE-494).

- Skill name: `supply-chain-hygiene`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/kubernetes-sigs/kueue/blob/HEAD/cmd/experimental/skills/reviewer/security/supply-chain-hygiene/SKILL.md
- Repository: kubernetes-sigs/kueue (2,719 GitHub stars when collected)

## SKILL.md

# Skill: Supply Chain Hygiene (CWE-295, CWE-494)

- Image references without a digest pin (`image: foo:latest` is a violation; require
  `@sha256:...`).
- `InsecureSkipVerify: true`, TLS verification bypass, or `--insecure` flags.
- `replace` directives in `go.mod` without a tracked issue and a target removal
  version.
- `curl | sh`, `wget | bash`, or scripts fetched from a URL inside a Dockerfile or
  Makefile.
- Third-party GitHub Actions / CI workflow steps pinned to a moving tag instead of a
  commit SHA.
- New direct dependencies without a one-line justification.

---

Source: https://www.openparable.com/skill/devops-security/supply-chain-hygiene (OpenParable). Cite the canonical URL above.