Generate SBOMs with Syft
Manual software inventories are incomplete and difficult to maintain. This skill guides repeatable Syft SBOM generation for containers, filesystems, archives, and CI pipelines.
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "sbom-syft" from https://skillstore.io/skills/agentsecops-sbom-syft.md and its manifest at https://skillstore.io/api/skills/agentsecops-sbom-syft/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "sbom-syft". Create a CycloneDX inventory for the release image and retain it for audit.
Expected outcome:
Using "sbom-syft". Compare dependencies between two application releases and highlight license changes.
Expected outcome:
Using "sbom-syft". Prepare a secure CI plan for generating and signing an SBOM.
Expected outcome:
The plan pins tool sources, verifies downloads, generates the SBOM, enforces scan policy, signs the attestation, and retains verification evidence.
Most detections are false positives caused by Markdown formatting, defensive examples, or fixed local operations. The template still includes a critical pipe-to-shell installer and instructions that download mutable artifacts without integrity verification. It also exposes a GitHub token to an unpinned action and contains CI controls that can fail open.
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
https://skillstore.io/skills/agentsecops-sbom-syft/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/agentsecops-sbom-syft?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/agentsecops-sbom-syft?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-sbom-syft/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/agentsecops-sbom-syft.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>AgentSecOps. (2026). sbom-syft security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-sbom-syft/audits/9@techreport{agentsecops-agentsecops-sbom-syft-2026,
author = {AgentSecOps},
title = {sbom-syft security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/agentsecops-sbom-syft/audits/9},
note = {Author version 0.1.0}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sbom-syft security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-sbom-syft/audits/9"
identifiers:
- type: other
value: "skillstore:agentsecops-sbom-syft:audit:9"
description: "Skillstore immutable audit report identifier"
Generate CycloneDX and SPDX inventories for each container release and retain them with build artifacts.
Add repeatable SBOM generation, validation, and artifact retention to an existing delivery pipeline.
Extract package and license data for compliance review across applications and container images.
Create a CycloneDX SBOM for <container-image>. Confirm the target, choose a safe output path, and explain how to validate the result.
Generate an SPDX SBOM for <project-path>. Exclude <patterns>, report detected ecosystems, and identify likely coverage gaps.
Design a CI job for <platform> that generates an SBOM for <artifact>. Pin dependencies, verify tools, retain outputs, and fail on missing reports.
Plan an advanced workflow for <image> that generates multiple SBOM formats, scans vulnerabilities, enforces policy, signs attestations, and verifies published evidence.
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r2
Ref
9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
Maintenance freshness
7/24/2026
Usage
7 downloads · 386 views
File structure
Build pytm Threat Models as Code
Threat modeling often becomes outdated and disconnected from architecture changes. This skill helps create pytm models, STRIDE analysis, and diagram workflows for security reviews and CI.
Secure Dockerfiles with Hadolint
Dockerfile mistakes can create insecure and unreliable container images. This skill provides Hadolint workflows, rule guidance, remediation examples, and reusable CI configurations.
Run Authorized Nuclei Security Scans
Known vulnerabilities and misconfigurations can escape manual review. This skill guides authorized Nuclei scans, template selection, validation, and reporting.
Audit Code with Semgrep
Security flaws can remain hidden across large, multilingual repositories. This skill guides focused Semgrep scans, triage, custom rules, CI gates, and standards-aligned remediation.
Scan Dependencies and Containers with Trivy
Security teams need consistent visibility into vulnerable components, images, and infrastructure configuration. This skill provides practical Trivy workflows for assessment, reporting, and remediation.
Automate OWASP ZAP DAST Scans
Security teams need repeatable runtime testing before releases. This skill guides authorized OWASP ZAP scans, authentication setup, API testing, and CI reporting.
Audit Dependency Security and License Risk
by sickn33
Dependency risk is hard to prioritize across vulnerabilities, licenses, updates, and supply chain signals. This skill guides Claude, Codex, and Claude Code through structured audits and remediation plans.
Audit AI Agent Skills Before Installation
by superagent-ai
Unvetted agent skills can hide prompt injection, credential theft, persistence, or unsafe dependencies. This skill combines offline scanning with guided semantic review.
Scan Dependency Security Risks
by sickn33
Dependency vulnerabilities and license risks are difficult to track across ecosystems. This skill guides scanning, prioritization, SBOM creation, and remediation planning.
Audit Dependency Security and Generate SBOMs
by Doyajin174
Dependency updates can introduce vulnerable or untrusted packages. This skill guides audits, safer updates, SBOM creation, and CI checks.
Audit Project Dependencies and Plan Secure Updates
by sickn33
Dependency risks are difficult to prioritize across vulnerabilities, licenses, maintenance, and supply chain signals. This skill organizes evidence and produces practical remediation and monitoring plans.
Map Project Dependencies
by DNYoussef
Large dependency trees can hide security, version, and architecture risks. This skill guides Claude, Codex, and Claude Code through dependency discovery, graph analysis, and reports.