Security

Enterprise Readiness

Assess and enhance software projects for enterprise-grade security, quality, and automation. Includes supply chain security (SLSA, signing, SBOMs), quality gates, and platform-specific hardening with dynamic scoring.

Latest release v4.20.0

Install

Choose a supported route below. Package contents, agent registration and runtime dependencies can differ between installers.

  1. Claude Code via this marketplace
    /plugin install enterprise-readiness@netresearch-claude-code-marketplace

    First add the marketplace once in Claude Code: /plugin marketplace add netresearch/claude-code-marketplace. Then install the selected plugin. For setup and installation scopes, see Claude Code plugin setup A plugin can include several skills and additional components.

  2. npx interactive skill selection
    npx skills add https://github.com/netresearch/enterprise-readiness-skill

    Requires Node.js 22.20+. Run from the target project, then choose the source skills and agents in the installer. Uses the skills CLI from skills.sh Installs skill instructions. Extra plugin hooks, commands and external runtime tools are not installed by this route.

  3. composer require PHP project, as a package
    composer require netresearch/enterprise-readiness-skill

    Allow the Composer skill installer to activate and approve skill registration when prompted. Requires netresearch/composer-agent-skill-plugin Discovers trusted skill packages and registers their instructions in AGENTS.md. Runtime tools may need separate setup.

  4. composer skills:add PHP project, direct source
    composer skills:add netresearch/enterprise-readiness-skill

    Install and activate netresearch/composer-agent-skill-plugin first; approve the selected source's skill registration. Provided by netresearch/composer-agent-skill-plugin Pins source repositories without a Packagist package and records them in composer.skills.lock. Runtime dependencies remain separate.

What you can do with it

  • OpenSSF Framework Alignment - Complete coverage across Scorecard, Best Practices Badge (Passing/Silver/Gold), SLSA, and S2C2F
  • Dynamic Scoring - Fair cross-stack assessment with platform/language-specific criteria
  • Supply Chain Security - SLSA provenance, artifact signing, SBOM generation, dependency scanning
  • Quality Gates - Testing layers, coverage thresholds, static analysis, secret scanning
  • Automation Scripts - Ready-to-use scripts for security hardening and compliance checks
  • Badge Progression - Guided path from Passing → Silver → Gold certification

What you get back

  • An assessment of project security, supply-chain controls and quality gates, with recommendations for the selected standards.

What it expects in your project

Check the source README for current examples, requirements and limitations. Open full README

Tags

  • security
  • quality-security