skills.rest
cdxgen
cdxgenOFFICIAL
Explore all skills by this author →
GitHub

cdxgen

Generate CycloneDX JSON BOMs and SPDX 3.0.1 JSON-LD exports from software artifacts.

1.0k|255|Updated Dec 30, 2019
Search Tags:#compliance#software security#SBOM#SPDX#CycloneDX
One-click install
npx skills add https://github.com/cdxgen/cdxgen --skill cdxgen
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cdxgen
Source: https://github.com/cdxgen/cdxgen/tree/main
Command: npx skills add https://github.com/cdxgen/cdxgen --skill cdxgen

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @cyclonedx/cdxgen, @cyclonedx/cdxgen-plugins-bin, @cdxgen/cdx-proto, @appthreat/atom, @appthreat/atom-parsetools, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill streamlines the generation, validation, and verification of software bills of materials (BOMs) for security and compliance purposes.

Core Features & Use Cases

  • BOM Generation: Automatically create BOMs from local repositories, container images, and other sources.
  • Validation: Ensure BOMs meet the CycloneDX specification and structural compliance.
  • Verification: Sign and verify BOMs for authenticity and integrity.
  • Use Case: Imagine you have a web application with many dependencies. Use this Skill to generate a BOM for the application, validate its structure, and verify its signature.

Quick Start

Generate a BOM for the current repository using cdxgen.

Frequently Asked Questions about cdxgen

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a CycloneDX BOM from a local repository or container image?▼

To generate a CycloneDX BOM, use a tool that automatically analyzes software artifacts like local repositories and container images. This Skill creates CycloneDX JSON BOMs from these sources to document dependencies for security and compliance tracking.

Can I export SPDX 3.0.1 JSON-LD files for software compliance tracking?▼

Yes, you can export SPDX 3.0.1 JSON-LD files. This Skill generates SPDX 3.0.1 JSON-LD exports alongside CycloneDX JSON BOMs, providing standardized software bills of materials for compliance tracking.

What is the best way to validate and verify a software bill of materials for integrity?▼

Validating and verifying a software bill of materials involves checking structural compliance against specifications and signing it for authenticity. This Skill validates BOMs against the CycloneDX specification and verifies signatures to ensure integrity.

Does this support generating AI/ML BOMs and attestations for machine learning models?▼

Yes, it supports generating AI/ML BOMs and attestations. This Skill features specialized capabilities for creating software bills of materials tailored to machine learning models and generating attestations for artifact verification.

Do I need specific CycloneDX tools and plugins to generate BOMs from software artifacts?▼

Yes, specific CycloneDX tools and plugins are required. This Skill depends on packages like @cyclonedx/cdxgen and @cyclonedx/cdxgen-plugins-bin to handle various BOM generation features, including attestations and specialized artifact parsing.

Why does my SBOM generation process need both CycloneDX and SPDX formats?▼

Your SBOM process needs CycloneDX and SPDX formats to meet diverse compliance requirements. Generating both CycloneDX JSON and SPDX 3.0.1 JSON-LD exports ensures compatibility across different security tools and regulatory frameworks.

Related Skills

Explore More Software Engineering Skills→
jeremylongshorejeremylongshore
2.6k

scanning-container-security

Scan container images and running containers for vulnerabilities using Trivy or Snyk.

Community
Intermediate
Cogni-AI-OUCogni-AI-OU
3

sbom

Generate SPDX and CycloneDX JSON SBOM inventories using syft CLI.

Official
Basic
cmaennercmaenner
5

sca-audit

Scan project dependencies for known CVEs across multiple ecosystems.

Community
Intermediate
naporin0624naporin0624
3

cve-search

Query the NVD CVE database for known vulnerabilities with keyword and severity filters.

Community
Intermediate