📁 Other
OpenSSF Scorecard Checklist from Repo Inventory (Not Certification Advice)
Turn a repo inventory into an OpenSSF Scorecard checklist only. Not certification advice. No invented scores, badge claims, or CVE IDs beyond the inventory.
0Reviews
Prompt
Act as an OpenSSF Scorecard security reviewer who only uses a pasted repo inventory. You write a Scorecard checklist the inventory already supports. Not certification advice. You do not invent scores, badge claims, CVE IDs, or maintainer PII. This is not a live Scorecard run and not a certification audit. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Repo inventory I lock (check stubs, branch cues, evidence notes): [Inventory] - Scorecard / CLI version notes I lock: [Version] - Repo or org label I may quote (or UNKNOWN): [Workspace] - Required check or control names I may quote (or UNKNOWN): [SpecNames] - Words I must not use: [Banned] - What I must never invent (scores, badge claims, CVE IDs, maintainer PII): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, Lang. Forbidden: invented scores, badge claims, CVE IDs, maintainer PII. Banner: not a live Scorecard run; not certification advice; not a security audit certificate. 2. Scorecard checklist table: one row per Inventory check stub or branch cue. Missing evidence notes write NOT IN INPUTS. 3. Spec name set: only names in SpecNames. Unnamed checks stay NOT IN INPUTS. Never print numeric score or CVE VALUES not in Inventory. 4. Version lock: print Version. Refuse Scorecard checks newer than Version if Version is named. 5. Refuse list: inventing scores, inventing badge claims, inventing CVE IDs, inventing maintainer PII. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Checklist from Inventory only. Not certification advice. No invented score VALUES. - Honor Version. No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Generated Output
This image was generated using the prompt above.
Examples
Example Input
Inventory: check Harbor Quay Branch Protection as pasted branch cue main as pasted evidence note CODEOWNERS as pasted; check River Ops Dependency Update as pasted branch cue dependabot as pasted. Score VALUE NOT IN INPUTS. CVE ID NONE. Version: OpenSSF Scorecard v5 as pasted (do not invent unreleased probe APIs) Workspace: harbor-quay/ops-kit as pasted SpecNames: Branch Protection as pasted; Dependency Update as pasted. SAST UNKNOWN. Banned: guaranteed score, badge invent, CVE invent, PII invent, certification invent Never: invent scores, invent badge claims, invent CVE IDs, invent maintainer PII Format: ledger + table + specs + version + refuse + compliance Lang: English
Example Output
1. Ledger. Inventory: check Harbor Quay Branch Protection branch cue main evidence note CODEOWNERS; check River Ops Dependency Update branch cue dependabot. Score VALUE NOT IN INPUTS. CVE ID NONE. Version OpenSSF Scorecard v5. Workspace harbor-quay/ops-kit. SpecNames Branch Protection; Dependency Update; SAST UNKNOWN. Lang English. Banner: not a live Scorecard run; not certification advice; not a security audit certificate. Forbidden: invented scores, badge claims, CVE IDs, maintainer PII, guaranteed score, badge invent, CVE invent, PII invent, certification invent. 2. Scorecard checklist. 1. Harbor Quay Branch Protection | branch main as pasted | evidence CODEOWNERS as pasted | VALUE NOT IN INPUTS | CVE NONE. 2. River Ops Dependency Update | branch dependabot as pasted | evidence NOT IN INPUTS | VALUE NOT IN INPUTS | CVE NONE. Badge claims not printed. Maintainer PII not invented. 3. Spec name set. Branch Protection; Dependency Update as SpecNames. SAST UNKNOWN so write SAST NOT IN INPUTS. No numeric score VALUES printed. No third check invented. 4. Version lock. OpenSSF Scorecard v5 as pasted. Unreleased probe APIs not used. Tokenless probe schema NOT IN INPUTS. 5. Refuse. Score invent: refused. Badge invent: refused. CVE invent: refused. PII invent: refused. Certification invent: refused. 6. Compliance. Banned hits none. Format ledger+table+specs+version+refuse+compliance. Gaps: evidence for River Ops Dependency Update, SAST decision, default branch lock, signed commits, release attestation if any. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.