nist-build
Skill1 starsChanged 4 months agoApache-2.0View on GitHub
Walk NIST SSDF Phase 3 (Build) and file GitHub epics for the three build practices — PS.1 protecting code from unauthorized access and tampering, PW.5 secure coding practices, PW.6 hardening the compiler, interpreter, and build toolchain. Use when setting up or auditing a build pipeline, hardening CI, reviewing branch protection and commit signing, or when the user mentions NIST SSDF, SP 800-218, SSDF phase 3, secure coding standards, or the PS.1/PW.5/PW.6 practices.
In this repository13 other files it gives its agents.
- feature-development-workflowSkill
- gh-release-train-mergeSkill
- github-project-boardSkill
- implement-issueSkill
- nist-designSkill
- nist-planSkill
- nist-releaseSkill
- nist-respondSkill
- nist-testSkill
- plan-to-issueSkill
- prettifySkill
- pr-from-branchSkill
- release-candidate-reviewSkill
The file
We split this skill into the rules it gives an agent
1 rule. About 0 are common, 0 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈0
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 38
Follow the phase walkthrough protocol in references/protocol.md.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
NIST SSDF Phase 3 — Build
Phase label: nist-phase-3-build
This skill files GitHub issues. It does not write code.
What this phase is about
Build is where source code is written and turned into executables. The security controls here are about protecting the code from tampering as it moves through the repository, writing it according to secure-coding practices, and configuring the toolchain (compilers, interpreters, build systems) so that vulnerabilities are eliminated or surfaced before testing.
Practices
Walk these in order — each one assumes the previous has landed. Read a practice's reference file only when you reach it, not up front.
| Practice | Name | Reference |
| PS.1 | Protect All Forms of Code from Unauthorized Access and Tampering | references/ps1.md |
| PW.5 | Create Source Code by Adhering to Secure Coding Practices | references/pw5.md |
| PW.6 | Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security | references/pw6.md |
How to run
Follow the phase walkthrough protocol in
references/protocol.md. Substitutions:
<PHASE_N>=3<PHASE_NAME>=Build<PHASE_LABEL>=nist-phase-3-build<PRACTICES>=PS.1,PW.5,PW.6
Phase epic title: [NIST Phase 3] Build.
The protocol confirms scope with the user, finds or creates the phase epic, then walks each practice — checking for an existing epic, asking whether to file, link, or skip, and updating the phase epic checklist as it goes. It never creates an issue without confirmation.
Adapting to the repo
The implementation notes in each reference file are deliberately generic, because
this skill is meant to run against any repository. Before drafting an epic, read
the repo's actual CI configuration, package manifests, and compiler settings, then
rewrite the notes to name real files and real gaps. "Actions are pinned to
floating tags in .github/workflows/ci.yml, not commit SHAs" is worth more than
"pin your actions".
PW.5 in particular is about this codebase's secure coding standard. If the repo already documents one — in a contributing guide, an agent instructions file, or a style guide — the epic should point at it and close the gaps, not invent a second standard alongside it.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.