skills.rest
do360now
do360nowCOMMUNITY
Explore all skills by this author →
Website𝕏@machadoclementGitHub

sbom-analysis

Analyzes SBOM files for format, metadata completeness, dependency risks, and license conflicts.

Updated Apr 19, 2026
Search Tags:#security#vulnerability#compliance#dependency analysis#supply chain#sbom
One-click install
npx skills add https://github.com/do360now/security-agents --skill sbom-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sbom-analysis
Source: https://github.com/do360now/security-agents/tree/main/.claude/skills/sbom-analysis
Command: npx skills add https://github.com/do360now/security-agents --skill sbom-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill enables detailed analysis of Software Bills of Materials (SBOMs), ensuring consistency, completeness, and security compliance.

Core Features & Use Cases

  • SBOM Format Identification: Determines whether the SBOM is CycloneDX 1.5 or SPDX 2.3 and checks structural validity.
  • NTIA Minimum Elements Verification: Assesses whether key metadata such as supplier, component name, version, and relationships are present and complete for compliance.
  • Risk and Vulnerability Analysis: Examines dependencies for known CVEs, transitive dependency risks, license conflicts, and stale dependencies.
  • VEX Status Interpretation: Reviews CSAF VEX documents to determine vulnerability impact and affected status.
  • Dependency Graph Construction: Maps direct and transitive dependencies, analyzing depth, orphan components, and high-risk dependencies.
  • License Conflict Detection: Identifies incompatible licenses and license omissions.

Quick Start

Invoke the sbom-analysis skill on your SBOM files to identify format, completeness, dependency vulnerabilities, and license risks immediately.

Frequently Asked Questions about sbom-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if my SBOM meets NTIA minimum elements compliance?▼

SBOM analysis verifies NTIA minimum elements compliance by evaluating metadata completeness, checking for supplier, component name, version, and dependency relationships. This ensures your software supply chain documentation meets regulatory audit requirements.

How do I detect license conflicts in a CycloneDX or SPDX SBOM?▼

License conflict detection in SBOM analysis identifies incompatible licenses and omissions by examining dependency declarations across both CycloneDX 1.5 and SPDX 2.3 formats. This highlights potential legal risks in your software components.

Can I analyze transitive dependency risks and known CVEs in my SBOM?▼

Yes, SBOM analysis examines dependencies for known CVEs and transitive dependency risks by constructing a dependency graph. It maps direct and transitive components to highlight high-risk dependencies and orphan components.

What is the best way to interpret VEX status for vulnerability impact in an SBOM?▼

Interpreting VEX status involves reviewing CSAF VEX documents to determine vulnerability impact and affected status. SBOM analysis integrates this review to clarify whether identified CVEs actually affect your specific components.

Does SBOM analysis work with both CycloneDX 1.5 and SPDX 2.3 formats?▼

Yes, SBOM analysis supports both CycloneDX 1.5 and SPDX 2.3 formats by identifying the format and checking structural validity. This ensures accurate dependency evaluation regardless of the standard used.

Related Skills

Explore More Software Engineering Skills→
UnitOneAIUnitOneAI
44

sbom-analysis

Analyze SBOM completeness against NTIA minimum elements and interpret VEX exploitability status.

Official
Intermediate
foutoucourfoutoucour

dependency-auditor

Audit project dependencies for vulnerabilities, outdated versions, and license risks.

Community
Advanced
jmaglyjmagly
175

supply-chain-forensics

Analyze software supply chains with SBOM generation, dependency verification, and SLSA mapping.

Community
Advanced
Hack23Hack23
23

open-source-governance

Enforce Hack23 Open Source Policy governance, security, and compliance standards.

Official
Advanced