agentsclimarketplace

Yocto security sbom

Skill Higangssh/yocto-agent-skills/skills/yocto-security-sbom

Official-doc-first Yocto Project and BitBake skills for AI coding agents

Install
npx -y skills add Higangssh/yocto-agent-skills --skill yocto-security-sbom

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Review and debug Yocto license metadata, LIC_FILES_CHKSUM, LICENSE_FLAGS, incompatible licenses, license manifests, SPDX/SBOM generation, CVE checking, archiver/copyleft source compliance, and security policy. Use for compliance, CVE, SBOM, license, commercial license, source archiving, or security review questions.

SKILL.md

2.2 KB, as published. Nobody here has run it

Yocto Security SBOM

Use this skill for security, license, CVE, SBOM, and compliance workflows. Treat class names and output paths as release-sensitive.

Evidence

Ask for or inspect:

target Yocto release
recipe LICENSE and LIC_FILES_CHKSUM
license QA error
image/license manifest output
SPDX/SBOM configuration and output
CVE check configuration and reports
archiver/copyleft configuration
commercial license policy

Useful commands:

bitbake -e <recipe> | rg '^(LICENSE|LIC_FILES_CHKSUM|LICENSE_FLAGS|LICENSE_FLAGS_ACCEPTED|INCOMPATIBLE_LICENSE|CVE|SPDX|ARCHIVER)[:=]'
bitbake -c populate_lic <recipe>
bitbake <image>
find tmp/deploy -maxdepth 4 -iname '*spdx*' -o -path '*licenses*'

Review Rules

  • LIC_FILES_CHKSUM is mandatory unless LICENSE = "CLOSED".
  • License checksum mismatch means upstream license text changed; inspect before updating the checksum.
  • Keep commercial license acceptance explicit and narrow.
  • Verify current release SBOM/CVE class names before recommending create-spdx, CVE classes, or output paths.
  • Use archiver/copyleft flows when source offer obligations matter.
  • Do not confuse build-time DEPENDS with packages included in final image license manifests.

References

Output

Answer with:

  1. license/security artifact being debugged
  2. release-sensitive class or variable to verify
  3. exact metadata or policy fix
  4. validation command and expected artifact
  5. compliance caveat if legal interpretation is required

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.