build-inventory

Enumerates services, repos, APIs, and related assets into schema-valid inventory files for the Defense Factory Inventory phase. Use when starting discovery or when asset ownership is unknown.

SKILL.md

---
name: build-inventory
description: Enumerates services, repos, APIs, and related assets into schema-valid inventory files for the Defense Factory Inventory phase. Use when starting discovery or when asset ownership is unknown.
metadata:
  source: https://github.com/kenhuangus/defense-factory-skills/tree/main/skills/build-inventory
---

# build-inventory

**Phase:** Inventory  
**Style:** Blue (defensive)

## When to use

- After prepare skills (policy + optional threat model)
- Before `security-scan` / `security-diff-scan`
- When ownership routing needs accurate `asset_id`s

## Preconditions

1. Authorization / ownership confirmed per SECURITY.md.
2. `.defense-factory/` exists (`python scripts/init_workspace.py`).
3. Read access to repos, cloud inventories, manifests, or deployment configs in scope.

## Procedure

1. Collect sources: git remotes, package manifests, Docker/K8s/IaC, API gateways, service catalogs, README deploy docs.
2. For each asset, create an entry matching `schemas/inventory-entry.schema.json`:
   - `id` (stable, e.g. `inv-<type>-<name>`)
   - `name`, `asset_type`, `owner`, `environment`, `discovered_at`, `source`
   - Optional `urls`, `repos`, `tags`, `exposure`, `notes`
3. Write:
   - `.defense-factory/inventory/inventory.json` — `{ "entries": [ ... ] }`
   - Optionally one file per asset under `.defense-factory/inventory/entries/`
4. Validate:

```powershell
python <skills-repo>\scripts\validate_artifacts.py .defense-factory\inventory\inventory.json --schema inventory-entry
```

5. Flag assets with `owner` unknown; list them for `route-ownership` later.
6. Cross-check threat-model priorities; tag high-priority assets.

## Required outputs

| Path | Schema |
| --- | --- |
| `.defense-factory/inventory/inventory.json` | `inventory-entry` (entries array) |

## Stop / refuse

- Do not scan or inventory out-of-scope third-party production systems without authorization.
- Do not store secrets (API keys, passwords) inside inventory notes.

## Next phase

`security-scan` (full) or `security-diff-scan` (change-scoped).

2 files

LICENSE1.0 KB
SKILL.md2.0 KB

--- name: build-inventory description: Enumerates services, repos, APIs, and related assets into schema-valid inventory files for the Defense Factory Inventory phase. Use when starting discovery or when asset ownership is unknown. metadata: source: https://github.com/kenhuangus/defense-factory-skills/tree/main/skills/build-inventory --- # build-inventory **Phase:** Inventory **Style:** Blue (defensive) ## When to use - After prepare skills (policy + optional threat model) - Before `security-scan` / `security-diff-scan` - When ownership routing needs accurate `asset_id`s ## Preconditions 1. Authorization / ownership confirmed per SECURITY.md. 2. `.defense-factory/` exists (`python scripts/init_workspace.py`). 3. Read access to repos, cloud inventories, manifests, or deployment configs in scope. ## Procedure 1. Collect sources: git remotes, package manifests, Docker/K8s/IaC, API gateways, service catalogs, README deploy docs. 2. For each asset, create an entry matching `schemas/inventory-entry.schema.json`: - `id` (stable, e.g. `inv-<type>-<name>`) - `name`, `asset_type`, `owner`, `environment`, `discovered_at`, `source` - Optional `urls`, `repos`, `tags`, `exposure`, `notes` 3. Write: - `.defense-factory/inventory/inventory.json` — `{ "entries": [ ... ] }` - Optionally one file per asset under `.defense-factory/inventory/entries/` 4. Validate: ```powershell python <skills-repo>\scripts\validate_artifacts.py .defense-factory\inventory\inventory.json --schema inventory-entry ``` 5. Flag assets with `owner` unknown; list them for `route-ownership` later. 6. Cross-check threat-model priorities; tag high-priority assets. ## Required outputs | Path | Schema | | --- | --- | | `.defense-factory/inventory/inventory.json` | `inventory-entry` (entries array) | ## Stop / refuse - Do not scan or inventory out-of-scope third-party production systems without authorization. - Do not store secrets (API keys, passwords) inside inventory notes. ## Next phase `security-scan` (full) or `security-diff-scan` (change-scoped).