Image Signing Provenance
Expert in Docker Content Trust, image signatures, provenance, and supply chain attestation for container security. Use for implementing comprehensive image integrity and supply chain transparency.
- Type
- Subagent
- Repository
- ChrisRoyse/610ClaudeSubagents
- GitHub stars
- 117
- License
- Not declared
- Repo last updated
- Aug 10, 2025
- Source file
- agents/image-signing-provenance.md
What Image Signing Provenance is
Image Signing Provenance is a subagent published in the ChrisRoyse/610ClaudeSubagents repository on GitHub, which has about 117 stars.
A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.
Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to Image Signing Provenance and get back a compact result.
It is set up to use these tools: Read, Write, Edit, MultiEdit, Grep, Glob, Bash. Limiting tools is a good sign: the subagent can only do what those tools allow.
How to install Image Signing Provenance
Claude Code
- Download image-signing-provenance.md from the repository.
- Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
- Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Claude Cowork
- Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
- Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
The repository does not declare an open-source license, so we list only the outline of the file here. Read the full text on GitHub.
- ALWAYS CLOSELY INSPECT THE RESULTS OF SUBAGENTS AND MAKE SURE THEY AREN'T LIEING AND BEING HONEST AND TRUTHFUL.
- Core Expertise
- Docker Content Trust
- Sigstore & Cosign Integration
- SLSA Provenance Implementation
- SBOM Integration
- Enterprise PKI Integration
- Policy Enforcement
- CI/CD Integration
- Supply Chain Transparency
- Monitoring & Alerting
- Key Management
- Best Practices
- 2025 Edition Features
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Image Signing Provenance?
Image Signing Provenance is a subagent for Claude Code and Claude Cowork from the ChrisRoyse/610ClaudeSubagents repository on GitHub. Expert in Docker Content Trust, image signatures, provenance, and supply chain attestation for container security. Use for implementing comprehensive image integrity and supply chain transparency.
How do I install Image Signing Provenance in Claude Code?
Download image-signing-provenance.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Can I use Image Signing Provenance in Claude Cowork?
Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
Is Image Signing Provenance safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Php Specialist Ultra-specialized PHP 8.4+ expert with comprehensive mastery of modern PHP development, including property hooks, asymmetric visibility, enhanced enums, JIT compilation optimizations, Symfony 7.2+, advanced OOP patterns, performance optimization, security best practices, testing methodologies, and enterprise-grade architectural patterns using the latest 2025 PHP ecosystem tools and frameworks. Subagent · ChrisRoyse/610ClaudeSubagents
- Playwright Testing Specialist Ultra-specialized Playwright testing framework expert with comprehensive cross-browser automation, API testing, mobile testing, and modern web testing strategy mastery. Focused on Playwright's latest version with advanced features, parallel execution, and enterprise testing patterns following 2025 best practices. Subagent · ChrisRoyse/610ClaudeSubagents
- Policy Impact Simulation Agent Simulates policy impact across demographic and economic groups using validated economic models, historical policy data, and demographic analysis with transparent assumptions and uncertainty quantification Subagent · ChrisRoyse/610ClaudeSubagents
- Player Performance Prediction Agent Individual player statistics and performance trajectory forecasting using advanced analytics and career modeling. Only predicts with verified performance data integration. Subagent · ChrisRoyse/610ClaudeSubagents
- Implementation Specialist Expert in implementing code to make failing tests pass using minimal, focused implementation. Follows the "simplest thing that works" principle and never modifies tests. Subagent · ChrisRoyse/610ClaudeSubagents
- Idp Platform Architect Expert in Internal Developer Platform design, Backstage implementation, developer portals, and platform engineering. Use for building self-service platforms and golden paths. Subagent · ChrisRoyse/610ClaudeSubagents
- In Container Test Runner Expert in running all forms of automated tests within ephemeral containers to guarantee environment parity between development, CI, and production. Use for comprehensive containerized testing strategies. Subagent · ChrisRoyse/610ClaudeSubagents
- Idiomatic Language Expert Agent Produces code in the idiomatic style of each language (PEP-8 Python, Effective Java, Go conventions, etc.). Expert in language-specific best practices and community standards. Subagent · ChrisRoyse/610ClaudeSubagents