Generate CycloneDX and SPDX SBOMs with VEX vulnerability tracking.
npx skills add https://github.com/DTMC-marketplace/governance --skill sbom-management
Please help me install this Agent Skill. Skill: sbom-management Source: https://github.com/DTMC-marketplace/governance/tree/main/skills/sbom-management Command: npx skills add https://github.com/DTMC-marketplace/governance --skill sbom-management
This Skill provides comprehensive guidance and tools for managing Software Bills of Materials (SBOMs), ensuring software supply chain security and compliance.
Use the sbom-management skill to generate a CycloneDX SBOM for your .NET solution.
High-intent search queries and answers about installing and using this skill.
To generate a CycloneDX or SPDX SBOM for software releases, this skill provides scripts and references that automate component extraction and document creation, ensuring your software bill of materials meets standard formats required for supply chain security and regulatory compliance.
VEX, or Vulnerability Exploitability eXchange, integrates with vulnerability tracking by providing statements on whether specific vulnerabilities affect your software. This skill guides you through appending VEX documents to your SBOM to communicate exploitability and reduce false positives during vulnerability management.
Implementing SLSA compliance and package verification involves following build provenance and integrity best practices. This skill offers guidance on applying SLSA frameworks and verifying package signatures to enhance trust and secure your software supply chain against tampering.
Yes, this skill supports Executive Order 14028 compliance by guiding the generation and distribution of accurate software bills of materials. It addresses regulatory requirements for software transparency by standardizing CycloneDX and SPDX outputs for all software components.
You can manage vulnerability scanning for a .NET solution by using this skill to generate a CycloneDX SBOM and integrating vulnerability data. It guides you through extracting dependencies and mapping them against known security advisories.
gtgspotClassify open-source licenses and map obligations to deployment models.
meridianhubAutomate security scanning with gosec, Trivy, and SBOM generation in CI/CD pipelines.
jmaglyAnalyze software supply chains with SBOM generation, dependency verification, and SLSA mapping.
Hack23Enforce Hack23 Open Source Policy governance, security, and compliance standards.
