Parse CycloneDX and SPDX SBOMs to map components to CVEs via NVD 2.0.
npx skills add https://github.com/DCx7C5/ai-marketplace --skill sbom-skill-md
Please help me install this Agent Skill. Skill: sbom-SKILL.md Source: https://github.com/DCx7C5/ai-marketplace/tree/main/skills/vulnerabilities/sca/sbom Command: npx skills add https://github.com/DCx7C5/ai-marketplace --skill sbom-skill-md
Parses Software Bills of Materials (SBOM) to identify supply chain vulnerabilities by mapping components to CVEs using the NVD CVE data and by constructing dependency graphs to support risk-based remediation and compliance reporting.
Analyze an SBOM file (CycloneDX or SPDX) to produce a vulnerability analysis report.
High-intent search queries and answers about installing and using this skill.
To scan an SBOM for vulnerabilities, you parse CycloneDX or SPDX files to extract components, then correlate those components with known CVEs using the NVD 2.0 API to identify supply chain risks.
Yes, dependency analysis and vulnerability correlation fully support both SPDX and CycloneDX SBOM formats, extracting component versions and mapping relationships to construct dependency graphs for remediation planning.
Risk scoring is computed by correlating extracted SBOM component versions against CVE data retrieved from the NVD 2.0 API, enabling automated prioritization of supply chain vulnerabilities for remediation workflows.
The best way to generate compliance reports from SBOM scans is to parse the dependency graph and CVE correlations into structured outputs, providing comprehensive documentation for audits and risk-based remediation planning.
Yes, you can visualize supply chain risks by constructing dependency graphs from parsed SBOM components, mapping the relationships between packages to trace vulnerability propagation paths and support targeted remediation.
Correlating SBOM components with CVEs requires querying the NVD 2.0 API for vulnerability data, meaning you need network access to retrieve the external CVE feeds necessary for accurate risk scoring and analysis.
farmountainGenerate CycloneDX and SPDX SBOMs and analyze dependencies for vulnerabilities.
chicanoandres702Scan dependencies for CVEs, license risks, and supply-chain issues.
SPIRAL-EDWINModel and analyze graph structures with Python and NetworkX.
naporin0624Query the NVD CVE database for known vulnerabilities with keyword and severity filters.
