Generate SPDX and CycloneDX JSON SBOM inventories using syft CLI.
npx skills add https://github.com/Cogni-AI-OU/cogni-ai-agent-skills --skill sbom-cogni-ai-ou
Please help me install this Agent Skill. Skill: sbom Source: https://github.com/Cogni-AI-OU/cogni-ai-agent-skills/tree/main/sbom Command: npx skills add https://github.com/Cogni-AI-OU/cogni-ai-agent-skills --skill sbom-cogni-ai-ou
SBOM generation resolves the lack of visibility into third-party dependencies by producing a standardized inventory of what software components are included in a build.
Install the syft CLI and run make sbom to generate both sbom.spdx.json and sbom.cdx.json for your project.
High-intent search queries and answers about installing and using this skill.
A Software Bill of Materials (SBOM) provides a standardized inventory of third-party dependencies included in a build, used for compliance reporting, vulnerability tracking, and supply chain risk assessment.
To generate SPDX and CycloneDX files, install the syft CLI and run the provided make sbom command, which outputs both sbom.spdx.json and sbom.cdx.json artifacts for your final build state.
Yes, you need the syft CLI installed and available in your environment, as the Skill relies on it to produce the SPDX JSON and CycloneDX JSON inventories during CI/CD or release readiness workflows.
Yes, SBOM generation resolves visibility gaps into third-party dependencies by producing standardized SPDX and CycloneDX inventories, directly supporting vulnerability tracking and supply chain risk assessment reporting.
The best way to automate dependency inventory creation is to integrate local reproducible SBOM generation commands into your CI/CD pipeline, outputting SPDX and CycloneDX JSON artifacts for the final build state.
SBOM generation is designed for local, reproducible execution from a repository rather than relying on ad-hoc manual exports, requiring the syft CLI to be available to produce accurate final build state inventories.
DuqueOMDetect security flaws in code, configurations, and containers before deployment.
DTMC-marketplaceGenerate CycloneDX and SPDX SBOMs with VEX vulnerability tracking.
MayaDispelerApply security checks across CI/CD pipelines with GitLeaks, Semgrep, Snyk, Trivy, and cosign.
RedHatProductSecurityGenerate SPDX and CycloneDX SBOMs with build provenance attestation.
