skills.rest
oscardlfr
oscardlfrCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sbom-analyze

Analyze CycloneDX JSON SBOMs for dependencies, licenses, and deprecated components.

1|Updated Mar 9, 2026
Search Tags:#security audit#dependency analysis#license compliance#sbom#software compliance
One-click install
npx skills add https://github.com/oscardlfr/AndroidCommonDoc --skill sbom-analyze
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sbom-analyze
Source: https://github.com/oscardlfr/AndroidCommonDoc/tree/main/skills/sbom-analyze
Command: npx skills add https://github.com/oscardlfr/AndroidCommonDoc --skill sbom-analyze

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill addresses the challenge of reviewing and understanding SBOMs by providing dependency statistics, license information, and identifying potential concerns.

Core Features & Use Cases

  • Dependency Statistics: Count and categorize dependencies by type and identify top publishers and groups.
  • License Analysis: Analyze license distribution and flag components with GPL licenses, missing versions, or deprecated components.
  • Use Case: Use this Skill to ensure compliance with license requirements and identify potential security concerns in your software dependencies.

Quick Start

Run the 'sbom-analyze' skill with the 'androidApp' module to review the SBOM for your Android application.

Frequently Asked Questions about sbom-analyze

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a CycloneDX SBOM for license compliance and security concerns?▼

To analyze a CycloneDX SBOM for license compliance, you can use a skill that parses JSON SBOM files to extract metadata, count dependencies, and flag concerns like GPL licenses and deprecated components.

What is the best way to flag deprecated components and GPL licenses in my software dependencies?▼

Flagging deprecated components and GPL licenses in software dependencies is done by analyzing your SBOM's license distribution and component metadata to identify potential compliance and security issues.

Can I extract dependency statistics and top publishers from a CycloneDX JSON file?▼

Yes, you can extract dependency statistics from a CycloneDX JSON file by parsing the SBOM to count and categorize dependencies by type, while identifying top publishers and groups.

Does SBOM analysis require access to the project root directory?▼

Yes, SBOM analysis requires access to the project root directory and SBOM files to successfully extract metadata and evaluate software compliance within your development workflow.

How do I review an Android application SBOM for software compliance?▼

To review an Android application SBOM for software compliance, run an analysis on the specific module to extract dependency statistics, analyze license distribution, and identify flagged concerns.

Related Skills

Explore More Software Engineering Skills→
686f6c61686f6c61
105

sbom-generate

Generate CycloneDX or SPDX SBOMs with dependencies and licenses.

Community
Advanced
baekenoughbaekenough
13

cve-triage

Triage CVE reports to assess impact, reproduction feasibility, and remediation options.

Community
Advanced
anishi1222anishi1222

dependency-audit

Analyze dependency definition files to identify known CVEs.

Community
Intermediate
devkenidevkeni
1

sca-security

Scan software dependencies for vulnerabilities and license compliance issues.

Community
Advanced