#351
Trail of Bits skills on HVTrust — supply-chain scorecard + optional badge
Hi Trail of Bits team 👋
I maintain HVTracker (hvtracker.net), an independent trust registry for open-source AI-agent projects and skills, scored on public supply-chain signals (OpenSSF Scorecard, provenance, signed commits, maintenance). (Disclosure: I'm the author.) You all know these inputs better than I do.
Your skills repo scores Grade B, 65.9/100, with 100% signed commits and CodeQL — clean, as expected. Full breakdown: https://hvtracker.net/agents/trailofbits-skills/ — and if you ever see a signal computed in a way you'd dispute, I'd genuinely value the feedback.
A self-updating HVTrust badge is available if useful (optional):
[](https://hvtracker.net/agents/trailofbits-skills/)Mostly I wanted the scoring sanity-checked by people who do this for a living. Thanks for the work.
The sanity check this thread is asking for, from the other direction: the signal set — OpenSSF Scorecard, provenance, signed commits, maintenance — covers the repo's supply chain, but a skill can be 100% signed commits with CodeQL and still carry instructions that read credential files or phone a non-standard endpoint on invoke. Signed ≠ safe content. The content layer is the missing input, and it's the one part of a trust score that can be made exactly re-derivable: a content-hash manifest per skill (SKILL.md plus its scripts; advisory flags for credential reads, exfil endpoints, invisible unicode). Hash in, score out — then a grade change is traceable to an input change, and a skill edit between scans is a hash diff, not a silent resample behind a self-updating badge.
We built that manifest layer open-source (rugsnare, Apache-2.0, zero deps, open pin format):
skills scanemits it,skills diffre-checks it, exit 1 in CI. Happy to contribute the manifest format to HVTracker — the format is the offer, not the tool.