netresearch/enterprise-readiness
skills/enterprise-readiness/SKILL.md
Use when evaluating projects for production or enterprise readiness, implementing supply chain security (SLSA, cosign, SBOMs, pnpm), hardening CI/CD pipelines, establishing quality gates (TYPO3: CI matrix PHP 8.2-8.5 x TYPO3 12.4/13.4/14.3 LTS), pursuing OpenSSF Best Practices Badge (Passing/Silver/Gold) or OSPS Baseline levels, reviewing code quality, writing ADRs, or configuring Git hooks and CI pipelines.
$ install --global
skillsauthnpx skillsauth add netresearch/enterprise-readiness-skill enterprise-readinessInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 29, 2026, 6:46 AM199.3s45 files scanned
SKILL.md
- name:
- enterprise-readiness
- description:
- Use when evaluating projects for production or enterprise readiness, implementing supply chain security (SLSA, cosign, SBOMs, pnpm), hardening CI/CD pipelines, establishing quality gates (TYPO3: CI matrix PHP 8.2-8.5 x TYPO3 12.4/13.4/14.3 LTS), pursuing OpenSSF Best Practices Badge (Passing/Silver/Gold) or OSPS Baseline levels, reviewing code quality, writing ADRs, or configuring Git hooks and CI pipelines.
- license:
- (MIT AND CC-BY-SA-4.0). See LICENSE-MIT and LICENSE-CC-BY-SA-4.0
- compatibility:
- Requires gh CLI, python3, cosign, docker.
- author:
- Netresearch DTT GmbH
- version:
- 4.15.0
- repository:
- https://github.com/netresearch/enterprise-readiness-skill
- allowed-tools:
- Bash(gh:*) Bash(python3:*) Bash(cosign:*) Read Write Glob Grep
Enterprise Readiness Assessment
Production/enterprise tier only — see
references/tier-framing.md.
When to Use
- Production/enterprise readiness evaluations
- Supply chain security: SLSA provenance, cosign signing, SBOMs
- CI/CD hardening, workflow permissions
- OpenSSF Best Practices (Passing/Silver/Gold), OSPS Baseline (L1/2/3)
- Scorecard optimization (Token-Permissions, Branch-Protection, Pinned-Deps)
- Code review, ADRs, changelogs, SECURITY.md
Assessment Workflow
- Discovery: Identify platform, languages, existing CI/CD, dependabot.yml
- Scoring: Apply checklists; check Scorecard, badge criteria, coverage
- Gap Analysis: List missing controls by severity
- Implementation: Apply fixes (SHA-pin actions, harden permissions, add workflows)
- Verification: Re-score and compare
Mandatory Workflows & Badges
Required coverage: CI, CodeQL, Scorecard, dependency review, composer audit, SBOM — as dedicated workflows or jobs calling the netresearch reusable. Badges: CI, Codecov, Scorecard, Best Practices, Baseline. See references/badges-and-workflows.md.
Key Hardening Patterns
- Permissions: Declare
permissions: contents: readat workflow-level; grant write only per-job - SHA pinning: Third-party actions pinned to SHA with version comment (
# v4.2.0). Org-internal reusable workflows use@main - Harden-Runner:
step-security/harden-runneras first step in every job; preferegress-policy: blockwith allowed-endpoints - Dependabot: Configure
dependabot.ymlwith all ecosystems (composer,npm,github-actions,docker); set up auto-merge workflow for dependency PRs usingpull_request_target - Coverage: Upload via
codecov-action; configurecodecov.ymlwith patch coverage threshold - Duplicate CI prevention: Scope
push:trigger tobranches: [main]whenpull_request:is also present - SLSA provenance: Use
actions/attest-build-provenancewithid-token: writeandattestations: writepermissions; verify withgh attestation verify - Security policy: Create
SECURITY.mdwith vulnerability disclosure process and response SLA (Critical: 7 days, High: 30 days)
Critical Rules
- NEVER interpolate
${{ github.event.* }}or${{ inputs.* }}inrun:blocks (script injection) - NEVER guess action versions -- fetch from GitHub API and verify SHA against tags
- ALWAYS include
https://URLs in badge justifications - ALWAYS configure auto-merge for repos with Dependabot/Renovate
References
| Reference | Use |
|-----------|-----|
| references/general.md | Always |
| references/scorecard-playbook.md | Scorecard optimization |
| references/badges-and-workflows.md | Badge URLs, workflows |
| references/mandatory-requirements.md | Checklist |
| references/ci-patterns.md | CI/CD, hooks |
| references/code-review.md | PR quality |
| references/documentation.md | ADRs, changelogs |
| references/slsa-provenance.md | SLSA Level 3 |
| references/signed-releases.md | Cosign/GPG |
| references/openssf-badge-silver.md | Silver |
| references/openssf-badge-gold.md | Gold |
| references/openssf-badge-baseline.md | OSPS Baseline |
| references/harden-runner-guide.md | Harden-Runner |
| references/solo-maintainer-guide.md | N/A criteria |
| references/npm-pnpm-supply-chain.md | pnpm |
Related skills: go-development, github-project, security-audit, git-workflow.
Related Skills
openclaw/openclaw-secret-scanning-maintainer
development
VerifiedTrustedCommunity
Maintainer-only workflow for handling GitHub Secret Scanning alerts on OpenClaw. Use when Codex needs to triage, redact, clean up, and resolve secret leakage found in issue comments, issue bodies, PR comments, or other GitHub content.
357,764SKILL.mdUpdated Apr 15, 2026
openclaw/openclaw-release-maintainer
development
VerifiedTrustedCommunity
Maintainer workflow for OpenClaw releases, prereleases, changelog release notes, and publish validation. Use when Codex needs to prepare or verify stable or beta release steps, align version naming, assemble release notes, check release auth requirements, or validate publish-time commands and artifacts.
357,764SKILL.mdUpdated Apr 10, 2026
openclaw/openclaw-qa-testing
development
VerifiedTrustedCommunity
Run, watch, debug, and extend OpenClaw QA testing with qa-lab and qa-channel. Use when Codex needs to execute the repo-backed QA suite, inspect live QA artifacts, debug failing scenarios, add new QA scenarios, or explain the OpenClaw QA workflow. Prefer the live OpenAI lane with regular openai/gpt-5.4 in fast mode; do not use gpt-5.4-pro or gpt-5.4-mini unless the user explicitly overrides that policy.
357,764SKILL.mdUpdated Apr 10, 2026
openclaw/openclaw-parallels-smoke
development
VerifiedTrustedCommunity
End-to-end Parallels smoke, upgrade, and rerun workflow for OpenClaw across macOS, Windows, and Linux guests. Use when Codex needs to run, rerun, debug, or interpret VM-based install, onboarding, gateway smoke tests, latest-release-to-main upgrade checks, fresh snapshot retests, or optional Discord roundtrip verification under Parallels.
357,764SKILL.mdUpdated Apr 10, 2026