sbom-analysis
From the author
Analyzes Software Bills of Materials (SBOMs) for completeness against NTIA minimum elements, interprets VEX status documents, performs transitive dependency risk analysis, and detects license conflicts. Supports CycloneDX 1.5 and SPDX 2.3 formats with CSAF-based VEX correlation. Auto-invoked when SBOM files are shared, supply chain risk questions arise, or VEX documents require interpretation.
Install
npx skills add UnitOneAI/SecuritySkills --skill sbom-analysis -a claude-code
Installs to .claude/skills/sbom-analysis/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 78
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- SBOM Generator with CycloneDXagentskillexchange/skillsGenerates Software Bill of Materials in CycloneDX 1.5 format using cdxgen and syft. Enriches component data with license detection from clearlydefined.io and vulnerability cross-referencing via OSV.dev.Security★ 60
- CycloneDX SBOM Generatoragentskillexchange/skillsGenerates Software Bill of Materials in CycloneDX format using cdxgen and Syft. Scans npm, pip, and Go modules for known CVEs via OSV.dev API integration.Engineering★ 60
- dependency-scanningseb1n/awesome-ai-agent-skillsScan project dependencies for known vulnerabilities, generate software bills of materials, and enforce license compliance across the software supply chain. Use when the user requests dependency scanning or provides relevant inputs for this workflow.Security★ 237
- sbom-generaterunxhq/runxDerive a CycloneDX software bill of materials from a supplied lockfile deterministically, digest-bound to the exact bytes, with license risks surfaced and unsupported or unpinned lockfiles refused.Other★ 105
- supply-chain-securitycoco-research/cocoUse for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.Security★ 797
- chain-recontonone-ai/tononeAudit existing dependency security — find unscanned packages, license violations, and SBOM gaps. Use when asked to "audit our dependencies", "do we have an SBOM", or "find license violations".Security★ 77
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in