Validate SBOMs against EU Cyber Resilience Act requirements and ENISA reporting standards.
npx skills add https://github.com/robotijn/ctoc --skill sbom-cra-checker
Please help me install this Agent Skill. Skill: sbom-cra-checker Source: https://github.com/robotijn/ctoc/tree/main/skills/compliance/sbom-cra-checker Command: npx skills add https://github.com/robotijn/ctoc --skill sbom-cra-checker
This Skill eliminates the risk of costly non-compliance with the EU Cyber Resilience Act (CRA) caused by invalid, unsigned, or poorly retained SBOMs, which can trigger fines of up to €15 million or 2.5% of global annual turnover for manufacturers of products with digital elements sold in the EU market.
Use the sbom-cra-checker skill to audit your project's SBOMs and CRA vulnerability reporting processes for EU regulatory compliance.
High-intent search queries and answers about installing and using this skill.
Auditing your SBOM for EU Cyber Resilience Act compliance involves validating it against NTIA minimum elements, verifying build provenance, and confirming SBOM signing. This process ensures your software bill of materials meets regulatory standards for vulnerability reporting.
CRA compliance for vulnerability reporting requires a complete notification runbook wired to the ENISA Single Reporting Platform (SRP). You must validate this 24-hour reporting process alongside your SBOM retention policies before market surveillance audits.
Validating SBOM signing and build provenance in a release pipeline requires checking that every shipped artifact has a compliant, signed software bill of materials. This pre-deployment audit verifies your supply chain security meets CRA standards.
Yes, a 10-year SBOM retention policy is required for EU market compliance under the Cyber Resilience Act. You must verify your release pipeline enforces this retention rule for all shipped artifacts with digital elements to avoid non-compliance penalties.
If your software bill of materials is missing NTIA minimum elements, it fails EU Cyber Resilience Act compliance validation. This invalid SBOM exposes your products to supply chain security risks and potential regulatory fines during market audits.
DTMC-marketplaceGenerate CycloneDX and SPDX SBOMs with VEX vulnerability tracking.
robotijnGenerate schema-conformant JSON reports for EU Cyber Resilience Act Article 14 incident filings.
marquesfelipAutomate artifact signing and provenance verification with Sigstore and Cosign.
686f6c61Generate CycloneDX or SPDX SBOMs with dependencies and licenses.
