sbom-syft

Name: sbom-syft
Availability: InStock
Author: AgentSecOps

Generates SBOMs from container images, file systems, and archives via Syft.

183|35|Updated Nov 19, 2025

Search Tags:#vulnerability #license #supply-chain #spdx #sbom #cyclonedx #syft

Ready to run

npx skills add https://github.com/AgentSecOps/SecOpsAgentKit --skill sbom-syft

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sbom-syft
Source: https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/secsdlc/sbom-syft
Command: npx skills add https://github.com/AgentSecOps/SecOpsAgentKit --skill sbom-syft

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) and references (resource) components.

What problem does it solve?

Syft SBOM generator provides visibility into software components across containers, filesystems, and archives to facilitate risk management and compliance.

Core Features & Use Cases

Supports CycloneDX, SPDX, and syft-json outputs for broad compatibility
Generates SBOMs for container images, filesystems, and archives to support vulnerability scanning and license compliance
Integrates SBOM generation into CI/CD workflows and supply-chain security programs

Quick Start

Run Syft against your target image or directory to produce an SBOM in CycloneDX or SPDX formats.

Frequently Asked Questions about sbom-syft

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate an SBOM for a container image?▼

To generate an SBOM for a container image, you run Syft against your target to produce a comprehensive Software Bill of Materials covering multiple ecosystems. This requires running Syft with Docker to scan the image.

What SBOM output formats are supported for compliance auditing?▼

Supported SBOM output formats for compliance auditing include CycloneDX, SPDX, and syft-json. These formats ensure broad compatibility for integrating component visibility into supply-chain security programs.

Can I scan file systems and archives for license management, or just containers?▼

You can scan file systems and archives for license management, not just containers. Syft generates SBOMs across all three target types to facilitate risk management and compliance workflows.

Do I need Docker to run Syft for supply-chain transparency?▼

You need Docker to run Syft for supply-chain transparency as specified in the requirements. Running Syft with Docker allows you to generate SBOMs for container images, file systems, and archives.

How do I integrate SBOM generation into CI/CD workflows?▼

You integrate SBOM generation into CI/CD workflows by running Syft to export CycloneDX, SPDX, or syft-json outputs. This automates vulnerability scanning and license compliance checks within your pipeline.

What is the best way to improve supply-chain transparency for software components?▼

The best way to improve supply-chain transparency is generating comprehensive SBOMs for container images and file systems. Syft provides visibility into software components to facilitate risk management and compliance.