Sbom license risk checker

Skill sisodiabhumca/agent-skills/skills/sbom-license-risk-checker

Production-Ready Agent Skills : product analytics, growth experiments, CRM, research synthesis, postmortems, data contracts, SaaS spend, compliance, architecture maps, and LLM eval and many more.

Install

npx -y skills add sisodiabhumca/agent-skills --skill sbom-license-risk-checker

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Vendor-neutral skill to check a CycloneDX SBOM for license policy compliance and emit a risk report.

SKILL.md

1.2 KB, as published. Nobody here has run it

When to invoke

You have a CycloneDX SBOM and need to flag packages with disallowed or unknown licenses.
You want an audit-friendly report that can be used in CI.

Inputs needed

--sbom: path to a CycloneDX JSON SBOM.
--policy: path to a JSON license policy containing:
- allow: list of allowed SPDX identifiers
- deny: list of denied SPDX identifiers
- warn: list of licenses that require review

Workflow

Load SBOM JSON.
Iterate components and extract license identifiers (best-effort).
Classify each component:
- allowed, warn, denied, or unknown
Emit JSON report with summary counts and per-component findings.

Output format

JSON:

summary
findings: list of {name, version, purl, licenses, classification, rationale}

Guardrails

If multiple licenses are present, choose the most restrictive classification (deny > warn > allow > unknown).
Do not guess licenses when missing; mark as unknown.
Keep results deterministic.

Reference code

check_sbom_licenses.py