Sbom generation

Skill yigityildiz0/universal-ai-skill-library/skills/common/sbom-generation

531 searchable AI Agent Skills for Claude Code, OpenAI Codex, and OpenCode — EN/TR catalog, platform and risk notes, direct ZIPs, and curated bundles.

Install

npx -y skills add yigityildiz0/universal-ai-skill-library --skill sbom-generation

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

3 things to look at

18 days oldThe repository was created 18 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Generate Software Bill of Materials (SBOM) for compliance with NTIA, EU CRA, and other regulatory requirements. Use when preparing for audits, compliance.

SKILL.md

11.2 KB, as published. Nobody here has run it

SBOM Generation

Generate complete, standards-compliant Software Bill of Materials documentation for security, compliance, and supply chain management.

When to Use This Skill

Use this skill when you need to:

Meet NTIA minimum element requirements
Comply with EU Cyber Resilience Act
Track software dependencies
Identify vulnerable components
Prepare for security audits
Establish supply chain transparency

Trigger phrases: "generate SBOM", "software bill of materials", "dependency inventory", "NTIA compliance", "EU CRA", "CycloneDX", "SPDX"

What This Skill Does

SBOM Standards

Standard	Format	Use Case
SPDX	JSON, RDF, Tag-Value	Industry standard, Linux Foundation
CycloneDX	JSON, XML	Security-focused, OWASP
SWID	XML	Software identification

Compliance Frameworks

NTIA Minimum Elements - US government requirements
EU Cyber Resilience Act (CRA) - European compliance
Executive Order 14028 - US federal suppliers
FDA Requirements - Medical device software

Instructions

NTIA Minimum Elements

The NTIA requires these seven elements:

Supplier Name - Who created the component
Component Name - Name of the software
Version - Component version string
Unique Identifier - PURL, CPE, or other ID
Dependency Relationship - How components relate
Author - Who created the SBOM
Timestamp - When SBOM was created

Generate SBOM by Language

Python

# Using pip-licenses
pip install pip-licenses
pip-licenses --format=json --output-file=sbom-licenses.json

# Using cyclonedx-bom
pip install cyclonedx-bom
cyclonedx-py -r requirements.txt -o sbom.json --format json

# Using syft (multi-language)
syft . -o cyclonedx-json=sbom.json

JavaScript/Node.js

# Using cyclonedx-npm
npx @cyclonedx/cyclonedx-npm --output-file sbom.json

# Using npm audit for vulnerabilities
npm audit --json > audit.json

# Using syft
syft . -o spdx-json=sbom.json

Java

# Using cyclonedx-maven-plugin
mvn org.cyclonedx:cyclonedx-maven-plugin:makeBom

# Using gradle plugin
# Add to build.gradle:
# plugins { id 'org.cyclonedx.bom' version '1.7.4' }
gradle cyclonedxBom

C#/.NET

# Using dotnet-cyclonedx
dotnet tool install -g CycloneDX
dotnet CycloneDX project.csproj -o sbom.json -j

# Using nuget
nuget locals all -list

Go

# Using cyclonedx-gomod
go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
cyclonedx-gomod mod -json=true > sbom.json

# Using syft
syft . -o cyclonedx-json=sbom.json

CycloneDX SBOM Example

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:550e8400-e29b-41d4-a716-446655440000",
  "version": 1,
  "metadata": {
    "timestamp": "2025-01-15T10:30:00Z",
    "tools": [
      {
        "vendor": "CycloneDX",
        "name": "cyclonedx-python",
        "version": "3.0.0"
      }
    ],
    "authors": [
      {
        "name": "Security Team",
        "email": "[email protected]"
      }
    ],
    "component": {
      "type": "application",
      "name": "my-application",
      "version": "1.0.0",
      "description": "My Application Description",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "purl": "pkg:pypi/[email protected]"
    },
    "manufacture": {
      "name": "Example Corp",
      "url": [
        "https://example.com"
      ]
    },
    "supplier": {
      "name": "Example Corp",
      "url": [
        "https://example.com"
      ],
      "contact": [
        {
          "name": "Support",
          "email": "[email protected]"
        }
      ]
    }
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "pkg:pypi/[email protected]",
      "name": "requests",
      "version": "2.31.0",
      "description": "Python HTTP for Humans.",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "purl": "pkg:pypi/[email protected]",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://requests.readthedocs.io"
        },
        {
          "type": "vcs",
          "url": "https://github.com/psf/requests"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:pypi/[email protected]",
      "name": "urllib3",
      "version": "2.0.7",
      "description": "HTTP library with thread-safe connection pooling",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "purl": "pkg:pypi/[email protected]"
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/[email protected]",
      "dependsOn": [
        "pkg:pypi/[email protected]"
      ]
    },
    {
      "ref": "pkg:pypi/[email protected]",
      "dependsOn": [
        "pkg:pypi/[email protected]",
        "pkg:pypi/[email protected]",
        "pkg:pypi/[email protected]",
        "pkg:pypi/[email protected]"
      ]
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-32681",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/"
      },
      "ratings": [
        {
          "source": {
            "name": "NVD"
          },
          "score": 6.1,
          "severity": "medium",
          "method": "CVSSv3"
        }
      ],
      "description": "Requests Session object does not verify requests after making first request with verify=False",
      "recommendation": "Upgrade to requests>=2.31.0",
      "affects": [
        {
          "ref": "pkg:pypi/[email protected]"
        }
      ]
    }
  ]
}

SPDX SBOM Example

{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "my-application-sbom",
  "documentNamespace": "https://example.com/sbom/my-application-1.0.0",
  "creationInfo": {
    "created": "2025-01-15T10:30:00Z",
    "creators": [
      "Tool: cyclonedx-python-3.0.0",
      "Organization: Example Corp"
    ],
    "licenseListVersion": "3.22"
  },
  "packages": [
    {
      "SPDXID": "SPDXRef-Package-my-application",
      "name": "my-application",
      "versionInfo": "1.0.0",
      "supplier": "Organization: Example Corp",
      "downloadLocation": "https://github.com/example/my-application",
      "filesAnalyzed": false,
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "Copyright 2025 Example Corp",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:pypi/[email protected]"
        }
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-requests",
      "name": "requests",
      "versionInfo": "2.31.0",
      "supplier": "Organization: Python Software Foundation",
      "downloadLocation": "https://pypi.org/project/requests/",
      "filesAnalyzed": false,
      "licenseConcluded": "Apache-2.0",
      "licenseDeclared": "Apache-2.0",
      "copyrightText": "Copyright Kenneth Reitz",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1"
        }
      ],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:pypi/[email protected]"
        },
        {
          "referenceCategory": "SECURITY",
          "referenceType": "cpe23Type",
          "referenceLocator": "cpe:2.3:a:python:requests:2.31.0:*:*:*:*:*:*:*"
        }
      ]
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relatedSpdxElement": "SPDXRef-Package-my-application",
      "relationshipType": "DESCRIBES"
    },
    {
      "spdxElementId": "SPDXRef-Package-my-application",
      "relatedSpdxElement": "SPDXRef-Package-requests",
      "relationshipType": "DEPENDS_ON"
    }
  ]
}

CI/CD Integration

# GitHub Actions
name: Generate SBOM

on:
  release:
    types: [published]
  workflow_dispatch:

jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Generate SBOM with Syft
        uses: anchore/sbom-action@v0
        with:
          artifact-name: sbom.spdx.json
          output-file: sbom.spdx.json
          format: spdx-json

      - name: Scan SBOM for vulnerabilities
        uses: anchore/scan-action@v3
        with:
          sbom: sbom.spdx.json
          fail-build: true
          severity-cutoff: high

      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.spdx.json

      - name: Attach SBOM to Release
        if: github.event_name == 'release'
        uses: softprops/action-gh-release@v1
        with:
          files: sbom.spdx.json

Vulnerability Scanning

# Using Grype with SBOM
grype sbom:sbom.json

# Using Trivy
trivy sbom sbom.json

# Using OSV-Scanner
osv-scanner --sbom=sbom.json

Tools

SBOM Generation

Syft - Multi-language, container support
CycloneDX tools - Language-specific generators
SPDX tools - Official SPDX tooling

Vulnerability Scanning

Grype - SBOM vulnerability scanner
Trivy - Comprehensive scanner
OSV-Scanner - Google's OSV database

SBOM Management

Dependency-Track - SBOM analysis platform
GUAC - Graph for Understanding Artifact Composition

Quality Checklist

Common Issues and Solutions

Issue: Missing transitive dependencies

Solution: Use tools that resolve full dependency tree:

syft . -o cyclonedx-json=sbom.json --scope all-layers

Issue: Incomplete license information

Solution: Combine multiple sources:

pip-licenses --format=json > licenses.json
# Merge with SBOM

Issue: No vulnerability data

Solution: Add vulnerability scanning step:

grype sbom:sbom.json -o json > vulnerabilities.json

Related Skills

dependency-security-audit - Security scanning
licensing-compliance - License checking
security-review - Security analysis

Version: 1.0.0 Last Updated: December 2025 Based on: AI Templates documentation_generation/sbom/

Iterative Refinement Strategy

This skill is optimized for an iterative approach:

Execute: Perform the core steps defined above.
Review: Critically analyze the output (coverage, quality, completeness).
Refine: If targets aren't met, repeat the specific implementation steps with improved context.
Loop: Continue until the definition of done is satisfied.

3 things to look at

What its author says it does

SKILL.md

SBOM Generation

When to Use This Skill

What This Skill Does

SBOM Standards

Compliance Frameworks

Instructions

NTIA Minimum Elements

Generate SBOM by Language

Python

JavaScript/Node.js

Java

C#/.NET

Go

CycloneDX SBOM Example

SPDX SBOM Example

CI/CD Integration

Vulnerability Scanning

Tools

SBOM Generation

Vulnerability Scanning

SBOM Management

Quality Checklist

Common Issues and Solutions

Issue: Missing transitive dependencies

Issue: Incomplete license information

Issue: No vulnerability data

Related Skills

Iterative Refinement Strategy

Keep looking