Generate SBOMs and detect vulnerabilities across multi-language codebases.
npx skills add https://github.com/chenchunrun/onyx-soc --skill sca-analyzer
Please help me install this Agent Skill. Skill: sca-analyzer Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/sca-analyzer Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill sca-analyzer
The Skill helps teams identify and mitigate software supply chain risks by analyzing component usage, SBOMs, and known vulnerabilities across dependencies.
Instruct the AI to scan a repository to generate an SBOM, run vulnerability checks, and produce a risk-focused report.
High-intent search queries and answers about installing and using this skill.
To generate an SBOM and check dependencies for known vulnerabilities, analyze your multi-language codebase using SBOM tooling like syft and cross-reference vulnerability databases to detect risks across direct and transitive dependencies.
Software supply chain risk assessment identifies and mitigates risks by analyzing component usage, SBOMs, and known vulnerabilities across dependencies. You need it when onboarding a new project to produce compliance reports and remediation plans.
Yes, you can analyze license risks across transitive dependencies in a multi-language project. The analysis applies to multi-language codebases to assess supply chain risks and generate structured outputs for compliance tracking.
Yes, vulnerability analysis works with syft for generating SBOMs. It utilizes SBOM tooling to identify software components and then queries vulnerability databases to deliver structured outputs and actionable remediation guidance.
To get remediation guidance for detected supply chain vulnerabilities, run an analyzer on your repository to scan components, assess license and vulnerability risks, and produce a risk-focused report with actionable insights.
The best way to produce a compliance report for a new project's dependencies is to run an SCA analyzer to generate an SBOM, run vulnerability checks, assess license risks, and output a structured remediation plan.
bartstcDetect project type and automate safe dependency updates across manifests.
hiddink-aiAutomate CVE report triage with security analysis and remediation planning.
jmaglyAnalyze software supply chains with SBOM generation, dependency verification, and SLSA mapping.
brenordvAudit software systems for security vulnerabilities and regulatory compliance.
