What problem does it solve?
Adding custom properties to CycloneDX BOM output risks leaking secrets, duplicating standard fields, or breaking the build when properties are undocumented. This Skill enforces a gated workflow so every new cdx: or internal: property is namespaced correctly, value-safe, and documented.
Core Features & Use Cases
- Standard-field-first gate: Checks whether data fits existing CycloneDX fields (supplier, externalReferences, evidence, pedigree, hashes, modelCard) before allowing a custom property.
- Naming and value hygiene rules: Enforces the
cdx:<ecosystem>:<field> convention and safe value shapes such as booleans, counts, and categories instead of raw secrets, URLs, or command lines.
- Documentation gate: Ensures every new property is registered in docs/CUSTOM_PROPERTIES.md, since lib/customProperties.poku.js fails the build on undocumented properties.
- Use Case: When adding a property like
cdx:npm:hasInstallScript to cdxgen output, use this Skill to verify naming, redact secret-bearing values, update the documentation table, and add a test asserting no secrets are emitted.
Quick Start
Review my new cdx: custom property for cdxgen and tell me whether it passes the naming, value hygiene, and documentation gates.
