nist-release
Skill1 starsChanged 4 months agoApache-2.0View on GitHub
Walk NIST SSDF Phase 5 (Release) and file GitHub epics for the three release practices — PS.2 verifying software release integrity (signing, checksums, provenance), PS.3 archiving each release and producing an SBOM, PW.9 shipping secure settings by default. Use when preparing or auditing a release process, adding artifact signing or SBOM generation, reviewing default configuration for insecure defaults, or when the user mentions NIST SSDF, SP 800-218, SSDF phase 5, SBOM, or the PS.2/PS.3/PW.9 practices.
In this repository13 other files it gives its agents.
- feature-development-workflowSkill
- gh-release-train-mergeSkill
- github-project-boardSkill
- implement-issueSkill
- nist-buildSkill
- nist-designSkill
- nist-planSkill
- nist-respondSkill
- nist-testSkill
- plan-to-issueSkill
- prettifySkill
- pr-from-branchSkill
- release-candidate-reviewSkill
The file
We split this skill into the rules it gives an agent
2 rules. About 0 are common, 1 is distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 39
Follow the phase walkthrough protocol in references/protocol.md.
- Distinctive: line 63
If the software ships no artifact to an external acquirer, say so and consider skipping PS.2 with a recorded reason rather than filing an …
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
NIST SSDF Phase 5 — Release
Phase label: nist-phase-5-release
This skill files GitHub issues. It does not write code.
What this phase is about
Release is the moment software leaves our control and reaches an acquirer. The controls in this phase make that handoff trustworthy: a way for the acquirer to verify that what they received has not been tampered with, an archive of everything that shipped (so it can be reconstructed later when a CVE lands against a dependency), and secure-by-default configuration so the software is not compromised on first install.
Practices
Walk these in order — each one assumes the previous has landed. Read a practice's reference file only when you reach it, not up front.
| Practice | Name | Reference |
| PS.2 | Provide a Mechanism for Verifying Software Release Integrity | references/ps2.md |
| PS.3 | Archive and Protect Each Software Release | references/ps3.md |
| PW.9 | Configure Software to Have Secure Settings by Default | references/pw9.md |
How to run
Follow the phase walkthrough protocol in
references/protocol.md. Substitutions:
<PHASE_N>=5<PHASE_NAME>=Release<PHASE_LABEL>=nist-phase-5-release<PRACTICES>=PS.2,PS.3,PW.9
Phase epic title: [NIST Phase 5] Release.
The protocol confirms scope with the user, finds or creates the phase epic, then walks each practice — checking for an existing epic, asking whether to file, link, or skip, and updating the phase epic checklist as it goes. It never creates an issue without confirmation.
Adapting to the repo
The implementation notes in each reference file are deliberately generic, because this skill is meant to run against any repository. Before drafting an epic, look at how the project actually ships — tagged releases, container images, published packages, or a deployment with no artifact at all — and rewrite the notes around that. A project that deploys a service and publishes nothing has a very different PS.2 than one that publishes a library other people install.
If the software ships no artifact to an external acquirer, say so and consider skipping PS.2 with a recorded reason rather than filing an epic that cannot be completed.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.