What problem does it solve? Modern applications depend on hundreds of third-party components, and most teams cannot answer which dependencies they ship, which CVEs are actually exploitable, or whether their CI/CD pipeline can be tampered with. This Skill provides a structured methodology for SBOM generation, dependency vulnerability verification, and pipeline hardening. ## Core Features & Use Cases - SBOM Generation and Auditing: Produce CycloneDX or SPDX inventories with cdxgen, Syft, or sbom-tool, then audit for unknown, deprecated, or license-conflicting components. - SCA and Reachability Verification: Scan with OSV-Scanner, Trivy, Dependency-Track, or Snyk, then verify which CVEs are actually reachable using CodeQL data-flow analysis and PoC validation. - CI/CD Pipeline Security: Audit GitHub Actions and GitLab CI configurations for script injection, over-privileged tokens, unpinned actions, secret leakage, and runner isolation gaps. - Use Case: A compliance team needs an SBOM for a customer audit. Generate one with cdxgen, scan it with OSV-Scanner, upload it to Dependency-Track for continuous monitoring, and verify the top CVEs are reachable before filing remediation tickets. ## Quick Start Generate an SBOM for this repository, scan it for known vulnerabilities, and tell me which critical CVEs are actually reachable in our code.
