agentsclimarketplace
Sign in

Sbom management

Skill Amey-Thakur/AI-SKILLS/skills/security/sbom-management

Produce signed software bills of materials from real artifacts and consume them to answer "are we affected" fast. Use when setting up build output, responding to a new advisory, or fielding a customer SBOM request.From its SKILL.md

Install
npx -y skills add Amey-Thakur/AI-SKILLS --skill sbom-management

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.1 KB, 699 tokens by cl100k_base, as published. Nobody here has run it

SBOM management

A software bill of materials (SBOM) is the ingredient list for what you shipped. Without one, the day a critical advisory lands you are grepping lockfiles across repos and guessing what is actually deployed. Generated right and kept current, an SBOM turns that scramble into a query.

Method

  1. Generate from the built artifact, not the source tree. Run syft against the final container image or binary: syft my-image:1.4 -o cyclonedx-json. Scanning source misses vendored code, build-time injections, and base-image packages, so the SBOM must describe what actually left the build.
  2. Pick one format and hold it. CycloneDX and SPDX are both machine readable; CycloneDX carries dependency graph and VEX in one document, SPDX is common for license and compliance work. Convert on demand with cyclonedx-cli convert rather than maintaining two source formats.
  3. Include the NTIA minimum elements. Every component needs supplier, name, version, a unique identifier (a PURL like pkg:npm/[email protected] or a CPE), dependency relationships, plus author and timestamp. An SBOM with no PURLs cannot be matched to an advisory feed and is decoration.
  4. Sign the SBOM and bind it to the artifact digest. Attach it as an attestation with cosign attest --predicate sbom.json --type cyclonedx so a consumer can confirm the SBOM belongs to that exact image and was not swapped. An unsigned SBOM is a claim, not evidence.
  5. Consume continuously, not once. Feed stored SBOMs to grype sbom:./sbom.json or load them into Dependency-Track, which re-evaluates every stored SBOM as new CVEs arrive. The point is that a fresh advisory flags an old release without anyone rebuilding it.
  6. Emit VEX to kill the false positives. Publish an OpenVEX or CycloneDX VEX statement marking unreachable findings not_affected with a justification like vulnerable_code_not_in_execute_path, so consumers and your own dashboard stop paging on a CVE you already triaged.
  7. Track coverage and freshness. Require an SBOM for every deployed artifact and regenerate it each release. A stale SBOM from three releases back answers "are we affected" confidently and wrongly.

Checks

  • Can you list every running service that contains log4j-core 2.14 from stored SBOMs in minutes, without rebuilding anything?
  • Does each release ship a signed SBOM whose component set matches what the image actually contains?
  • When a new CVE publishes, does something re-scan existing SBOMs automatically, or only the next build?

Boundaries

This skill covers producing and consuming the inventory. Hardening the pipeline that builds and signs artifacts belongs to supply-chain-defense, and gating or removing an individual risky package belongs to dependency-auditing. Format mandates from a specific regulator defer to that program's own requirements.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most dependency audit skills give in 699 tokens

Counted across 162 of the 192 authors here whose files we hold, read 2026-09-06

  • Verify the gh tool is installed before startingin 10 of 162, across 6 files
  • Find git repositories for all direct dependenciesin 9 of 162, across 5 files
  • Evaluate every dependency against the risk criteriain 9 of 162, across 5 files
  • Normalize repository names to full URLsin 9 of 162, across 5 files
  • Query exact star and issue counts using ghin 9 of 162, across 5 files
  • Ask the user to install gh if missingin 7 of 162, across 3 files
  • Omit low-risk dependencies from the reportin 7 of 162, across 3 files
  • Run the full test suite after each changein 7 of 162
  • Flag dependencies matching any risk criterion with clear reasonsin 6 of 162, across 2 files
  • Commit lockfiles and pin exact dependency versionsin 6 of 162, across 5 files
  • Detect package managers from manifest filesin 6 of 162
  • Review the changelogs for breaking changesin 5 of 162, across 2 files

Said here and by no other author read

  • Generate the SBOM from the built artifact, not the source tree
  • Run syft against the final container image or binary
  • Pick one format and hold it
  • Convert formats on demand rather than maintaining two
  • Include the NTIA minimum elements
  • Sign the SBOM and bind it to the artifact digest

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.