Explain CycloneDX specification concepts, schemas, and governance for SBOMs.
npx skills add https://github.com/CycloneDX/skills --skill cyclonedx-spec
Please help me install this Agent Skill. Skill: cyclonedx-spec Source: https://github.com/CycloneDX/skills/tree/main Command: npx skills add https://github.com/CycloneDX/skills --skill cyclonedx-spec
Provides authoritative guidance on the CycloneDX specification, schemas, and governance to help Claude answer questions about SBOMs and related BOMs with accuracy.
Use the CycloneDX-spec skill to fetch authoritative guidance for CycloneDX 1.6 and 1.7.
High-intent search queries and answers about installing and using this skill.
Model SBOM data using the CycloneDX JSON schema by referencing the official property taxonomy and specification prose for versions 1.6 and 1.7 to ensure structural correctness and consistency.
VEX and VDR in CycloneDX attestations represent vulnerability exploitability exchange and vulnerability disclosure reports respectively, both governed by official specification conventions for distinct risk modeling scenarios.
Validate a CycloneDX BOM-Link reference by checking the relationship against the official JSON schema definitions and property taxonomy provided for specification versions 1.6 and 1.7.
Yes, you can use CycloneDX specifications for cryptographic bill of materials as the core scope explicitly supports CBOM alongside SBOM and MBOM modeling scenarios using official guides.
CycloneDX 1.7 includes updates to the property taxonomy and JSON schema, building upon the 1.6 specification to provide authoritative guidance for SBOM, VDR, VEX, and attestation modeling.
CycloneDX SBOM validation fails against the JSON schema when data modeling does not adhere to the official specification prose, property taxonomy, and ISO House Style conventions defined for versions 1.6 and 1.7.
cdxgenReview cdxgen changes for CycloneDX schema compliance and semantic correctness.
cdxgenGenerate CycloneDX JSON BOMs and SPDX 3.0.1 JSON-LD exports from software artifacts.
AgentSecOpsScan container images and SBOMs for vulnerabilities with Grype.
devkeniScan software dependencies for vulnerabilities and license compliance issues.
