Generate CycloneDX or SPDX SBOMs with dependencies and licenses.
npx skills add https://github.com/686f6c61/alfred-dev --skill sbom-generate
Please help me install this Agent Skill. Skill: sbom-generate Source: https://github.com/686f6c61/alfred-dev/tree/main/skills/seguridad/sbom-generate Command: npx skills add https://github.com/686f6c61/alfred-dev --skill sbom-generate
This Skill automates the generation of a Software Bill of Materials (SBOM), a crucial inventory of all software components within a project, essential for compliance with regulations like the European Cyber Resilience Act (CRA) and for robust supply chain security.
Use the sbom-generate skill to create a CycloneDX SBOM for the current project.
High-intent search queries and answers about installing and using this skill.
To generate a Software Bill of Materials (SBOM) for Cyber Resilience Act compliance, detect your project's ecosystem, list all direct and transitive dependencies with versions and licenses, and output the inventory in CycloneDX or SPDX format.
CycloneDX and SPDX are both industry-standard output formats for a software bill of materials. SPDX focuses heavily on license compliance information, while CycloneDX is often tailored for supply chain security and vulnerability tracking.
You can list transitive dependencies and their licenses for supply chain security by analyzing your project's lock files to capture the full dependency tree, verifying completeness, and associating the components with a specific software version.
Yes, you can include non-package components alongside direct dependencies in an SBOM. Generating the inventory involves detecting the project ecosystem and capturing all components, ensuring the final report accurately reflects every part of the software.
Yes, SBOM generation verifies completeness against lock files to ensure accurate dependency tracking. It associates the generated inventory with a specific software version, validating that all direct and transitive dependencies are correctly captured.
The best way to automate software bill of materials generation for continuous supply chain security is to systematically detect your project's ecosystem, extract dependencies from lock files, and output standardized CycloneDX or SPDX documents for every software version.
endorlabsIdentify project dependencies and scan them for known vulnerabilities using Endor Labs SCA.
farmountainGenerate CycloneDX and SPDX SBOMs and analyze dependencies for vulnerabilities.
DTMC-marketplaceGenerate CycloneDX and SPDX SBOMs with VEX vulnerability tracking.
Endor-Solutions-ArchitectureExport, import, analyze, and compare CycloneDX or SPDX SBOMs.
