Generate validated CycloneDX or SPDX SBOMs from resolved lockfiles.
npx skills add https://github.com/rocklambros/rcs --skill generating-sbom
Please help me install this Agent Skill. Skill: generating-sbom Source: https://github.com/rocklambros/rcs/tree/main/skills/security/generating-sbom Command: npx skills add https://github.com/rocklambros/rcs --skill generating-sbom
This Skill removes the uncertainty and manual effort from producing a trustworthy Software Bill of Materials for software releases, container images, and compliance reviews.
Ask the skill to generate a validated CycloneDX or SPDX SBOM for your resolved repository or container image and to report any missing licenses, suppliers, or dependency information.
High-intent search queries and answers about installing and using this skill.
To generate a valid SBOM for a polyglot monorepo, this Skill selects the appropriate ecosystem tool for Python, Node.js, Go, or Maven, reads resolved lockfiles directly, and validates schema requirements.
CycloneDX and SPDX are both valid SBOM formats for software compliance, but this Skill selects the appropriate output based on your downstream consumer requirements and checks required metadata like supplier and PURL for both.
Yes, you can create an SPDX or CycloneDX SBOM from a container image by applying this Skill to extract dependency information, read resolved packages, and validate the output against required compliance schemas.
To check an SBOM for missing license or supplier data, this Skill validates metadata completeness during generation and explicitly flags any components lacking required license, supplier, or PURL information before release.
Generating an SBOM does not require re-resolving dependencies, because this Skill reads directly from resolved lockfiles to ensure accuracy and avoid dependency drift across your Python, Node.js, or Rust environments.
The best way to audit a supply chain for vulnerability scanning is to generate a validated SBOM using CycloneDX or SPDX, ensuring all dependency relationships and PURLs are accurately captured for downstream security tools.
cosmixScan project dependencies for vulnerabilities, outdated packages, and license issues.
DTMC-marketplaceGenerate CycloneDX and SPDX SBOMs with VEX vulnerability tracking.
ils15Audit codebases for vulnerabilities, dependencies, container security, SBOM, PII, and compliance.
AyalaKaguyaDiscover and install Nx plugins in a monorepo using pnpm and Nx CLI.
