Generate SPDX 2.3 and CycloneDX 1.5 SBOMs with dependency details.
npx skills add https://github.com/FrogAi/Xenopus --skill sbom-generator
Please help me install this Agent Skill. Skill: sbom-generator Source: https://github.com/FrogAi/Xenopus/tree/main/Gemini/Skills/Gemini%203.1%20Pro/sbom-generator Command: npx skills add https://github.com/FrogAi/Xenopus --skill sbom-generator
Produces standards-compliant SBOMs to give teams complete visibility into direct and transitive dependencies across multiple ecosystems.
Invoke sbom-generator on your project to produce a valid CycloneDX 1.5 or SPDX 2.3 SBOM with direct and transitive dependencies.
High-intent search queries and answers about installing and using this skill.
To generate a software bill of materials for multi-ecosystem projects, invoke the tool to enumerate direct and transitive dependencies across npm, PyPI, Maven, Go, and container images, outputting valid SPDX 2.3 or CycloneDX 1.5 formats.
SPDX 2.3 and CycloneDX 1.5 are both supported SBOM standards that detail dependencies with name, version, purl, license, checksum, supplier, and download-location, plus dep-edges to ensure compliance and auditability across different ecosystems.
Yes, you can produce SBOMs for multi-ecosystem projects spanning npm, PyPI, crates, Maven, Go, NuGet, Gems, Packagist, and container images, capturing both direct and transitive dependencies in a single standards-compliant output.
If required SBOM tooling is unavailable, the generator provides a transparent fallback and clearly flags any partial outputs, ensuring you maintain visibility into dependency accuracy and compliance without hiding missing data.
Transitive dependencies are represented with name, version, purl, license, checksum, supplier, and download-location fields, plus dep-edges that map the relationships between direct and transitive components for full auditability.
No, the SBOM generator uses read-only tooling with live spec fetch to enumerate dependencies and verify outputs, ensuring your project files remain unmodified while producing audit-ready SBOMs.
GabeujinIdentify sponsorable dependencies in GitHub repositories via deps.dev API and funding metadata.
UnitOneAIAnalyze SBOM completeness against NTIA minimum elements and interpret VEX exploitability status.
naporin0624Query the NVD CVE database for known vulnerabilities with keyword and severity filters.
ForgePlanClassify ForgePlan Map Pack edges as 'typed-link' or 'code-dep' and grep-verify 'code-dep' edges.
