Supply Chain Security Tools Integrated in reverse-skill: Trivy, Syft, and Gitleaks

The reverse-skill repository integrates Trivy, Syft, and Gitleaks as its core supply chain security toolkit to automate SBOM generation, vulnerability scanning, and secret detection across CI/CD pipelines.

The reverse-skill repository provides a dedicated Supply-Chain Security skill that hardens software delivery pipelines through automated tooling. This implementation leverages three industry-standard open-source utilities to address distinct attack vectors in the software supply chain. Understanding how these supply chain security tools are configured and orchestrated enables security teams to replicate this hardened workflow in their own environments.

Core Supply Chain Security Toolkit

The skill defines a complete workflow in skills/supply-chain-security/SKILL.md that orchestrates three specialized tools. Each utility targets a specific layer of the supply chain, from dependency provenance to runtime vulnerabilities and credential hygiene.

Syft for SBOM Generation

Syft generates Software Bill of Materials (SBOM) in SPDX/JSON format from container images or directories. According to the tool chain table in skills/supply-chain-security/SKILL.md (lines 53-55), installation follows the official Anchore installer:

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh

The workflow invokes Syft (lines 44-47) to produce machine-readable component lists:

syft . -o spdx-json > sbom.json

Trivy for Vulnerability Scanning

Trivy performs comprehensive scans across filesystems, container images, and Infrastructure-as-Code (IaC) configurations. The documentation lists installation via apt install trivy and implements three distinct scan modes (lines 70-74):

# Filesystem scan for local dependencies

trivy fs .

# Container image scan

trivy image nginx:latest

# IaC configuration scan (Terraform, CloudFormation, etc.)

trivy config .

Gitleaks for Secret Detection

Gitleaks detects hard-coded secrets, API keys, and credentials before they enter version control. The skill specifies installation via go install github.com/gitleaks/gitleaks/v8 and integrates the tool into CI/CD pre-commit hooks (lines 99-101):

gitleaks detect --source=. --redact --exit-code=1

Implementation Workflow

The three tools operate sequentially within the supply chain security pipeline defined in the repository.

SBOM Generation Phase

During the initial phase, Syft creates a comprehensive inventory of all dependencies and components. This provenance data serves as the baseline for subsequent vulnerability correlation and compliance auditing.

Software Composition Analysis

Trivy executes filesystem, image, and IaC scans to surface Common Vulnerabilities and Exposures (CVEs). This covers both third-party package vulnerabilities and configuration drifts that could expose the application to supply chain attacks.

Credential Hygiene Enforcement

Gitleaks runs during pre-commit hooks to ensure no secrets are committed to the repository. This prevents credential leakage that could compromise the integrity of the software delivery pipeline.

Routing and Configuration

The routing configuration explicitly maps the supply-chain skill to these three tools. In skills/routing.md (lines 56-59), the path directs all automated supply chain assessments through the Trivy/Syft/Gitleaks entry point, ensuring consistent security scanning across the project.

Additional configuration files reinforce this tooling selection:

• skills/supply-chain-security/references/sbom-sca-methodology.md documents the rationale for tool choices
• RULES.md and RULES_zh.md enumerate accepted supply chain tooling
• kali/RULES-kali.md lists the same trio for penetration-testing contexts

Summary

• The reverse-skill repository implements a hardened supply chain security workflow using Trivy, Syft, and Gitleaks
• Syft handles SBOM generation in SPDX/JSON format via skills/supply-chain-security/SKILL.md
• Trivy performs multi-layer scanning (filesystem, container, IaC) to detect CVEs
• Gitleaks enforces credential hygiene through pre-commit secret detection
• Routing configuration in skills/routing.md mandates these tools for all automated assessments

Frequently Asked Questions

What supply chain security tools are integrated in the reverse-skill repository?

The repository integrates three primary tools: Trivy for vulnerability scanning, Syft for SBOM generation, and Gitleaks for secret detection. These are defined in skills/supply-chain-security/SKILL.md and enforced through the routing configuration in skills/routing.md.

How does the reverse-skill workflow use Syft for SBOM generation?

The workflow invokes Syft using syft . -o spdx-json to generate machine-readable Software Bill of Materials in SPDX format. This command is documented in lines 44-47 of skills/supply-chain-security/SKILL.md and establishes the dependency baseline for security auditing.

Can Trivy scan both container images and Infrastructure-as-Code in this implementation?

Yes. According to the source documentation (lines 70-74), Trivy is configured to run three scan types: filesystem scans (trivy fs .), container image scans (trivy image <name>), and IaC configuration scans (trivy config .), covering both runtime and deployment vulnerabilities.

Where is Gitleaks integrated in the CI/CD pipeline?

Gitleaks is integrated into pre-commit hooks as specified in lines 99-101 of skills/supply-chain-security/SKILL.md. The command gitleaks detect --source=. --redact --exit-code=1 runs automatically to prevent credential leakage before code enters version control.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}