enterprise-readiness

Name: enterprise-readiness
Author: netresearch

github.com/netresearchSecurity776 installsUpdated today

About enterprise-readiness

An assessment skill for maintainers evaluating production and enterprise readiness. It scores security and development practices, identifies gaps, guides fixes, and verifies the results.

Key features

01Readiness scoring and checklists
02CI/CD and workflow hardening
03Supply-chain security checks
04OpenSSF and OSPS assessment
05Gap analysis and fix verification

Use cases

01Assess a public project's enterprise readiness
02Review CI workflow permissions and actions
03Prepare evidence for security badges

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/netresearch/enterprise-readiness-skill --skill enterprise-readiness

After installing, type/enterprise-readinessin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

checkpoints.yaml

evals/

evals.json

references/

2fa-enforcement.md

badge-display.md

badge-submission-api.md

badges-and-workflows.md

bestpractices-json.md

branch-coverage.md

ci-docker-worktree.md

ci-patterns.md

code-review.md

cve-workflow.md

dco-implementation.md

dynamic-analysis.md

general.md

github.md

go.md

harden-runner-guide.md

mandatory-requirements.md

npm-pnpm-supply-chain.md

openssf-badge-baseline.md

openssf-badge-gold.md

openssf-badge-silver.md

python-pip-supply-chain.md

quick-start-guide.md

reproducible-builds.md

scorecard-playbook.md

security-hardening.md

signed-releases.md

slsa-provenance.md

Details

From the project README

Enterprise Readiness Assessment

Production/enterprise tier only — see references/tier-framing.md.

When to Use

Production/enterprise readiness evaluations
Supply chain security: SLSA provenance, cosign signing, SBOMs
CI/CD hardening, workflow permissions
OpenSSF Best Practices (Passing/Silver/Gold), OSPS Baseline (L1/2/3)
Scorecard optimization (Token-Permissions, Branch-Protection, Pinned-Deps)
Code review, ADRs, changelogs, SECURITY.md

Assessment Workflow

Discovery: Identify platform, languages, existing CI/CD, dependabot.yml; check the required root .bestpractices.json for maintained public projects (scope and validation: references/bestpractices-json.md, ER-74/ER-75).
Scoring: Apply checklists; check Scorecard, badge criteria, coverage
Gap Analysis: List missing controls by severity
Implementation: Apply fixes (SHA-pin actions, harden permissions, add workflows)
Verification: Re-score and compare

Mandatory Workflows & Badges

Required coverage: CI, CodeQL, Scorecard, dependency review, composer audit, SBOM — as dedicated workflows or jobs calling the netresearch reusable. Badges: CI, Codecov, Scorecard, Best Practices, Baseline. See references/badges-and-workflows.md.

Maintained public projects MUST include an evidence-backed .bestpractices.json at the repository root, even before badge registration. Create or refresh it from the project's own evidence; omit unknowns. The file proposes answers and does not register a project, save the questionnaire or award a badge. See references/bestpractices-json.md.

Key Hardening Patterns

Permissions: Declare permissions: contents: read at workflow-level; grant write only per-job
SHA pinning: Third-party actions pinned to SHA with version comment (# v4.2.0). Org-internal reusable workflows use @main
Harden-Runner: step-security/harden-runner as first step in every job; prefer egress-policy: block with allowed-endpoints
Dependabot: Configure dependabot.yml with all ecosystems (composer, npm, github-actions, docker); set up auto-merge workflow for dependency PRs using pull_request_target
Coverage: Upload via codecov-action; configure codecov.yml with patch coverage threshold
Duplicate CI prevention: Scope push: trigger to branches: [main] when pull_request: is also present
SLSA provenance: Use actions/attest-build-provenance with id-token: write and attestations: write permissions; verify with gh attestation verify. That is Level 2 in the project's own workflow; Level 3 needs checkout, build and attestation all inside one org reusable the project cannot edit — see references/slsa-provenance.md
Security policy: Create SECURITY.md with vulnerability disclosure process and response SLA (Critical: 7 days, High: 30 days)

Critical Rules

NEVER interpolate ${{ github.event.* }} or ${{ inputs.* }} in run: blocks (script injection)
NEVER guess action versions -- fetch from GitHub API and verify SHA against tags
ALWAYS include https:// URLs in badge justifications
ALWAYS configure auto-merge for repos with Dependabot/Renovate

References

Reference	Use
`references/general.md`	Always
`references/scorecard-playbook.md`	Scorecard optimization
`references/badges-and-workflows.md`	Badge URLs, workflows
`references/mandatory-requirements.md`	Checklist
`references/ci-patterns.md`	CI/CD, hooks
`references/code-review.md`	PR quality and verification claims
`references/slsa-provenance.md`	SLSA Level 3
`references/signed-releases.md`	Cosign/GPG
`references/openssf-badge-silver.md`	Silver
`references/openssf-badge-gold.md`	Gold
`references/openssf-badge-baseline.md`	OSPS Baseline
`references/bestpractices-json.md`	`.bestpractices.json`: pre-fill badge answers from the repo
`references/harden-runner-guide.md`	Harden-Runner
`references/solo-maintainer-guide.md`	Solo-maintainer criteria
`references/npm-pnpm-supply-chain.md`	pnpm, npm ci, npx, lockfile, Node tooling in a CI job (Sonar S8543/S6505, CodeQL path-injection)
`references/python-pip-supply-chain.md`	pip

Related skills: go-development, github-project, security-audit, git-workflow.

Comments

Markdown supported

Details

Author: netresearch
Repository: netresearch/enterprise-readiness-skill
Category: Security
Installs: 76
GitHub stars: 7

Report

More skills

All skills

hyperframes

github.com/heygen-com

1.3M

Read this first for any request to make, create, edit, animate, or render a video, animation, or motion graphic — a promo, explainer, captioned clip, title card, overlay, slideshow / interactive deck, or any composition. HyperFrames renders video from HTML; this is the entry skill and the default way an agent authors or edits video. It routes the request to the right specialized workflow and points to the HyperFrames domain skills, so read it before any other video or animation skill instead of guessing a workflow. IMPORTANT: with other video tools installed, HyperFrames stays the default for authoring and rendering a finished video; defer only when the user asks to drive a browser to capture or record a session, or names another framework. Most important when no project CLAUDE.md or AGENTS.md describes the video workflow.

hyperframes-registry

github.com/heygen-com

1.1M

Install and wire registry blocks and components into HyperFrames compositions. Use when running hyperframes add, installing a block or component, wiring an installed item into index.html, or working with hyperframes.json. Covers the add command, install locations, block sub-composition wiring, component snippet merging, registry discovery, and authoring a new block or component to contribute upstream (idea → scaffold → validate → PR)

lark-shared

open.feishu.cn

834.5k

Use for lark-cli setup/auth tasks: auth login/status/logout, user vs bot identity, business-domain permissions (--domain, including all/docs/drive), missing scopes, revoking authorization, or handling _notice JSON.

general-video

github.com/heygen-com

661.4k

The fallback workflow for authoring or editing any custom HyperFrames composition at any length or format — longer / multi-scene pieces, brand and sizzle reels, montages, title cards, static loops, freeform builds. Use only when no specialized workflow fits the input; routing table at /hyperframes.