Generates SBOMs from container images, file systems, and archives via Syft.
npx skills add https://github.com/AgentSecOps/SecOpsAgentKit --skill sbom-syft
Please help me install this Agent Skill. Skill: sbom-syft Source: https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/secsdlc/sbom-syft Command: npx skills add https://github.com/AgentSecOps/SecOpsAgentKit --skill sbom-syft
Syft SBOM generator provides visibility into software components across containers, filesystems, and archives to facilitate risk management and compliance.
Run Syft against your target image or directory to produce an SBOM in CycloneDX or SPDX formats.
High-intent search queries and answers about installing and using this skill.
To generate an SBOM for a container image, you run Syft against your target to produce a comprehensive Software Bill of Materials covering multiple ecosystems. This requires running Syft with Docker to scan the image.
Supported SBOM output formats for compliance auditing include CycloneDX, SPDX, and syft-json. These formats ensure broad compatibility for integrating component visibility into supply-chain security programs.
You can scan file systems and archives for license management, not just containers. Syft generates SBOMs across all three target types to facilitate risk management and compliance workflows.
You need Docker to run Syft for supply-chain transparency as specified in the requirements. Running Syft with Docker allows you to generate SBOMs for container images, file systems, and archives.
You integrate SBOM generation into CI/CD workflows by running Syft to export CycloneDX, SPDX, or syft-json outputs. This automates vulnerability scanning and license compliance checks within your pipeline.
The best way to improve supply-chain transparency is generating comprehensive SBOMs for container images and file systems. Syft provides visibility into software components to facilitate risk management and compliance.
jrjsmrtnHarden container images with digest pinning, verified fetches, and grype/syft scanning.
devkeniScan software dependencies for vulnerabilities and license compliance issues.
spallempatiEnforce immutable CI builds and generate signed SBOMs for supply chain security.
zzw4257Generate Software Bill of Materials from container images and filesystems.
