sbom

Generate CycloneDX SBOMs with Syft, resolve licenses, and export CSV reports.

8.1k|1.2k|Updated Feb 24, 2026

Search Tags:#compliance #supply-chain #dependency-management #sbom #cyclonedx #syft #license-resolution

Ready to run

npx skills add https://github.com/NVIDIA/OpenShell --skill sbom-nvidia

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sbom
Source: https://github.com/NVIDIA/OpenShell/tree/main/.agents/skills/sbom
Command: npx skills add https://github.com/NVIDIA/OpenShell --skill sbom-nvidia

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SBOM generation and license resolution automate visibility into software supply chains, enabling compliant reporting and risk assessment.

Core Features & Use Cases

Generate CycloneDX SBOMs using Syft and export to CSV for stakeholder review.
Resolve missing or hash-based licenses by querying public registries (crates.io, npm, PyPI).
Produce release-artifact SBOMs on demand without committing to the repository.

Quick Start

Run the full SBOM workflow to generate a CycloneDX SBOM, resolve licenses, and export a CSV for review.

Frequently Asked Questions about sbom

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate a CycloneDX SBOM and export it to CSV?▼

To generate a CycloneDX SBOM and export it to CSV, run the full SBOM workflow which uses Syft to create the SBOM and export tooling to produce a CSV file for stakeholder review.

How do I resolve missing or hash-based licenses from public registries?▼

License resolution for missing or hash-based licenses is handled by querying public registries such as crates.io, npm, and PyPI to fetch accurate licensing details for dependencies.

Do I need Syft to generate SBOMs for OpenShell projects?▼

Yes, Syft is required to generate CycloneDX SBOMs for OpenShell projects, serving as the core tool for SBOM generation within the build and release workflows.

Can I produce release-artifact SBOMs on demand without committing them to the repository?▼

Yes, you can produce release-artifact SBOMs on demand without committing them to the repository, using the CSV export tooling located in the deploy/sbom workflow.

What is SBOM generation and license resolution used for in software supply chains?▼

SBOM generation and license resolution automate visibility into software supply chains, enabling compliant reporting and risk assessment for build and release workflows.