Security embedded Dev

Reviews AI/ML model supply chains for security risks including model provenance verification, training data lineage, fine-tuning pipeline integrity, inferenc...

This skill is a defensive, instruction-only checklist for reviewing ML model supply chains and is internally consistent. Before using it: (1) confirm you have authorization to review any target systems and artifacts; (2) be aware the agent will need read access to repo files, CI configs, or model documentation to produce a useful report — it will not and should not request cloud credentials itself; (3) expect gaps where the skill recommends checking cloud IAM or signed provenance unless you explicitly provide access via your normal, secure workflows; (4) note the minor name mismatch (registry name vs SKILL.md name) and verify you intended to install this particular skill; (5) do not grant broad secrets or make the agent execute downloaded model code — the skill already warns against execution.

Type: OpenClaw Skill Name: supply-chain-enterprise-security-skill Version: 1.0.0 The skill bundle is a legitimate security assessment tool designed to guide an AI agent through a review of AI/ML model supply chains. It provides structured methodology and search patterns (using Grep and Glob) to identify common vulnerabilities like unsafe deserialization (pickle), unverified model provenance, and insecure training pipelines. The SKILL.md file includes explicit safety instructions to prevent the agent from executing untrusted code or falling victim to prompt injection during its analysis.