skills.rest
lukehinds
lukehindsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sbom

Generates a CycloneDX Software Bill of Materials for a repository as JSON.

Updated May 20, 2026
Search Tags:#compliance#archival#supply-chain#sbom#cyclonedx#software-inventory
One-click install
npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill sbom-lukehinds
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sbom
Source: https://github.com/lukehinds/scrutineer-attest-test/tree/main/skills/sbom
Command: npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill sbom-lukehinds

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires git-pkgs, and includes scripts (resource) components.

What problem does it solve?

Generates a standardized, machine-readable inventory of software components to support compliance, auditing, and archival records across repositories.

Core Features & Use Cases

  • Produces a CycloneDX Software Bill of Materials for a repository to enable downstream tooling, governance, and traceability.
  • Integrates with CI/CD pipelines to generate a JSON SBOM file (report.json) that can be stored with releases and scanned for dependency management.
  • Use Case: When you need a formal component inventory for regulatory reviews, security assessments, or archival documentation.

Quick Start

Run the wrapper script to generate the SBOM and write the output to report.json.

Frequently Asked Questions about sbom

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a CycloneDX SBOM for my git repository?▼

To generate a CycloneDX SBOM, run the wrapper script against your repository and redirect the output to a file like report.json. This produces a standardized software inventory for compliance and audits.

What is a Software Bill of Materials used for in CI/CD pipelines?▼

A Software Bill of Materials provides a machine-readable inventory of software components used in CI/CD pipelines. It supports dependency management, security assessments, and regulatory reviews by ensuring traceability.

Do I need git-pkgs installed to create a CycloneDX software inventory?▼

Yes, you need git-pkgs on your PATH to create a CycloneDX software inventory. The script relies on this dependency to analyze the repository and output the JSON document.

Can I use this generated SBOM for regulatory reviews and archival documentation?▼

Yes, you can use the generated SBOM for regulatory reviews and archival documentation. It produces a formal component inventory suitable for audits, governance, and compliance across projects of varying complexity.

Does the generated SBOM output support downstream tooling and dependency scanning?▼

Yes, the CycloneDX JSON output supports downstream tooling and dependency scanning. By writing the report to report.json, it can be stored with releases and integrated into governance workflows.

What format does the SBOM script output for software component visibility?▼

The SBOM script outputs a CycloneDX JSON document for software component visibility. This machine-readable format can be redirected to report.json for storage and compliance tracking.

Related Skills

Explore More Software Engineering Skills→
riftzen-bitriftzen-bit

configure-ecc

Install and configure Everything Gemini Code components with verification and optional optimization.

Community
Advanced
Cogni-AI-OUCogni-AI-OU
3

sbom

Generate SPDX and CycloneDX JSON SBOM inventories using syft CLI.

Official
Basic
viktorbezdekviktorbezdek
10

workflow-automation

Automate CI/CD pipelines, git worktrees, and release workflows.

Community
Advanced
Endor-Solutions-ArchitectureEndor-Solutions-Architecture
2

endor-sbom

Export, import, analyze, and compare CycloneDX or SPDX SBOMs.

Official
Advanced