Yocto security sbom

Skill Higangssh/yocto-agent-skills/skills/yocto-security-sbom

Review and debug Yocto license metadata, LIC_FILES_CHKSUM, LICENSE_FLAGS, incompatible licenses, license manifests, SPDX/SBOM generation, CVE checking, archiver/copyleft source compliance, and security policy. Use for compliance, CVE, SBOM, license, commercial license, source archiving, or security review questions.From its SKILL.md

Install

npx -y skills add Higangssh/yocto-agent-skills --skill yocto-security-sbom

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.1 KB, as published. Nobody here has run it

Yocto Security SBOM

Use this skill for security, license, CVE, SBOM, and compliance workflows. Treat class names and output paths as release-sensitive.

Evidence

Ask for or inspect:

target Yocto release
recipe LICENSE and LIC_FILES_CHKSUM
license QA error
image/license manifest output
SPDX/SBOM configuration and output
CVE check configuration and reports
archiver/copyleft configuration
commercial license policy

Useful commands:

bitbake -e <recipe> | rg '^(LICENSE|LIC_FILES_CHKSUM|LICENSE_FLAGS|LICENSE_FLAGS_ACCEPTED|INCOMPATIBLE_LICENSE|CVE|SPDX|ARCHIVER)[:=]'
bitbake -c populate_lic <recipe>
bitbake <image>
find tmp/deploy -maxdepth 4 -iname '*spdx*' -o -path '*licenses*'

Review Rules

LIC_FILES_CHKSUM is mandatory unless LICENSE = "CLOSED".
License checksum mismatch means upstream license text changed; inspect before updating the checksum.
Keep commercial license acceptance explicit and narrow.
Verify current release SBOM/CVE class names before recommending create-spdx, CVE classes, or output paths.
Use archiver/copyleft flows when source offer obligations matter.
Do not confuse build-time DEPENDS with packages included in final image license manifests.

References

Read references/security-sbom.md.
Read references/classes-core.md for license, archiver, create-spdx, and release-sensitive security classes.
Read references/migration.md for SBOM/CVE release changes.

Output

Answer with:

license/security artifact being debugged
release-sensitive class or variable to verify
exact metadata or policy fix
validation command and expected artifact
compliance caveat if legal interpretation is required

What ships with it: 3 files

11.2 KB alongside SKILL.md

references/

Gives 0 of the 12 instructions most security skills give

Counted across 666 of the 889 authors here whose files we hold, read 2026-09-06

Use parameterized queries for database accessin 82 of 666, across 79 files
Hash passwords with BCryptin 55 of 666, across 39 files
Implement rate limiting for public endpointsin 48 of 666, across 34 files
Use environment variables for secretsin 35 of 666
Scan dependencies for vulnerabilitiesin 35 of 666, across 24 files
Validate and sanitize all user inputin 35 of 666, across 32 files
Add security headers to all responsesin 34 of 666, across 20 files
Validate all external input at the system boundaryin 26 of 666, across 25 files
Use parameterized queries to prevent SQL injectionin 25 of 666, across 13 files
Store secrets in Vault or environment variablesin 25 of 666, across 10 files
Run containers as a non-root userin 21 of 666, across 18 files
Validate all input using Bean Validationin 19 of 666, across 5 files

Said here and by no other author read

Inspect recipe license and checksum metadata
Verify current release SBOM and CVE class names
Validate license checksums before updating
Keep commercial license acceptance explicit and narrow
Use archiver flows for source offer obligations
Read security and migration reference documentation

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.