skills.rest
RedHatProductSecurity
RedHatProductSecurityOFFICIAL
Explore all skills by this author →
Website𝕏@RedHatSecurityGitHub

sbom-provenance

Generate SPDX and CycloneDX SBOMs with build provenance attestation.

47|5|Updated Apr 25, 2026
Search Tags:#dependency analysis#provenance#cybersecurity#supply chain#sbom#software compliance
One-click install
npx skills add https://github.com/RedHatProductSecurity/prodsec-skills --skill sbom-provenance
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sbom-provenance
Source: https://github.com/RedHatProductSecurity/prodsec-skills/tree/main/module/skills/sbom-provenance
Command: npx skills add https://github.com/RedHatProductSecurity/prodsec-skills --skill sbom-provenance

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires syft, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps developers and security teams generate comprehensive Software Bill of Materials (SBOM) reports to increase supply chain transparency and support compliance.

Core Features & Use Cases

  • Generate SBOMs in formats like SPDX and CycloneDX for container images and software projects.
  • Attest build provenance, including source code, build system, and parameters, to verify software authenticity.
  • Use Case: When releasing a new version of an AI application, generate an SBOM to document all components and dependencies, aiding compliance and security audits.

Quick Start

Use the sbom-provenance skill to produce an SBOM for your container image or code directory.

Frequently Asked Questions about sbom-provenance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an SBOM for a container image?▼

To generate an SBOM for a container image, you can use this skill to produce standardized reports in SPDX or CycloneDX formats, utilizing the syft tool for dependency analysis and software compliance.

What is build provenance attestation in software releases?▼

Build provenance attestation verifies software authenticity by documenting source code, build system, and parameters. This skill uses SLSA frameworks to generate provenance attestation for your software releases.

When do I need an SBOM for software compliance?▼

You need an SBOM for software compliance when releasing new application versions to document all components and dependencies. This skill helps developers and security teams increase supply chain transparency and support security audits.

Does this SBOM generation skill work with CycloneDX and SPDX formats?▼

Yes, this SBOM generation skill supports both CycloneDX and SPDX formats. It produces standardized reports for container images and code directories to ensure supply chain transparency.

Do I need syft to attest build provenance?▼

Yes, you need syft installed as a dependency to generate SBOMs. The skill requires syft for SBOM generation and SLSA frameworks to properly attest build provenance for your software releases.

Can I automate SBOM generation in build pipelines?▼

Yes, you can automate SBOM generation in build pipelines. This skill supports usage in build pipelines and compliance documentation processes to automatically produce SBOMs and build provenance reports for software releases.

Related Skills

Explore More Software Engineering Skills→
vecearvecear

artifact-sbom-publisher

no

Community
Advanced
patricio0312revpatricio0312rev
5

artifact-sbom-publisher

Generate SBOMs and publish artifacts with provenance metadata in CI/CD pipelines.

Community
Advanced
BagelHoleBagelHole
46

sbom-supply-chain

Generate, sign, and verify SBOMs and provenance attestations with Syft, Grype, and Cosign.

Community
Intermediate
Muath2000Muath2000

supply-chain-analyst

Analyze software supply chain risks and generate SBOMs.

Community
Advanced