skills.rest
x402agent
x402agentCOMMUNITY
Explore all skills by this author →
Website𝕏@clawddevsGitHub

sbom

Generate CycloneDX SBOMs for OpenShell projects and export CSV reports with resolved licenses.

Updated Apr 20, 2026
Search Tags:#compliance#csv#dependency-management#sbom#cyclonedx#syft#license-resolution
One-click install
npx skills add https://github.com/x402agent/openclawd-stack --skill sbom
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sbom
Source: https://github.com/x402agent/openclawd-stack/tree/main/openclawd-stack/OpenShell-main/.agents/skills/sbom
Command: npx skills add https://github.com/x402agent/openclawd-stack --skill sbom

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automatically generate and maintain Software Bill of Materials (SBOMs) for OpenShell projects, providing visibility into dependencies and licenses to support compliance reviews.

Core Features & Use Cases

  • Generate CycloneDX SBOMs with Syft for software projects
  • Resolve missing licenses via public registries and license maps
  • Export SBOM results to CSV for auditing and reporting

Quick Start

Run the sbom workflow to generate a CycloneDX JSON SBOM and a CSV report for your project.

Frequently Asked Questions about sbom

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a CycloneDX SBOM for software compliance auditing?▼

Generate a CycloneDX SBOM for compliance auditing by running the workflow to scan project dependencies with Syft. It produces a JSON SBOM and resolves missing licenses to support software supply-chain governance reviews.

Can I export SBOM results to CSV for reporting and auditing?▼

Export SBOM results to CSV for reporting and auditing by running the workflow. It generates a CSV report alongside the CycloneDX JSON output to provide dependency and license visibility for compliance checks.

What is the best way to resolve missing licenses in a software bill of materials?▼

Resolve missing licenses in a software bill of materials by using the workflow to query public registries and apply license maps. This remediates incomplete license data for accurate artifact reporting across CI pipelines.

Does Syft work with OpenShell projects for dependency management and SBOM generation?▼

Syft works with OpenShell projects for dependency management and SBOM generation. The workflow uses Syft to scan project dependencies and output a CycloneDX SBOM for software supply-chain governance.

When do I need to generate an SBOM for CI pipelines and supply-chain governance?▼

Generate an SBOM for CI pipelines and supply-chain governance when you need visibility into dependencies and licenses for compliance reviews. The workflow orchestrates SBOM generation and license resolution across development pipelines.

Related Skills

Explore More Software Engineering Skills→
vecearvecear

artifact-sbom-publisher

no

Community
Advanced
NVIDIANVIDIA
8.1k

sbom

Generate CycloneDX SBOMs with Syft, resolve licenses, and export CSV reports.

Official
Intermediate
AgentSecOpsAgentSecOps
183

sca-blackduck

Identify open-source component vulnerabilities and license risks across CI/CD pipelines.

Official
Advanced
devkenidevkeni
1

sca-security

Scan software dependencies for vulnerabilities and license compliance issues.

Community
Advanced