Agent skill · security · aiskillstore
sbom-syft
Software Bill of Materials (SBOM) generation using Syft for container images, filesystems, and archives. Detects packages across 28+ ecosystems with multi-format output support (CycloneDX, SPDX, syft-json). Enables vulnerability assessment, license compliance, and supply chain security. Use when: (1) Generating SBOMs for container images or applications, (2) Analyzing software dependencies and packages for vulnerability scanning, (3) Tracking license compliance across dependencies, (4) Integrating SBOM generation into CI/CD for supply chain security, (5) Creating signed SBOM attestations for software provenance.
Why this skill is useful
Adds specific commands and workflows for generating SBOMs that enhance vulnerability management and license compliance, which the AI wouldn't reliably generate on its own.
What it needs
Requires docker installed locally. About 7k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Syft SBOM Generator Overview Syft is a CLI tool and Go library for generating comprehensive Software Bills of Materials (SBOMs) from container images and filesystems. It provides visibility into packages and dependencies across 28+ ecosystems, supporting multiple SBOM formats (CycloneDX, SPDX) for vulnerability management, license compliance, and supply chain security. Supported Ecosystems Languages & Package Managers: Alpine (apk), C/C++ (conan), Dart (pub), Debian/Ubuntu (dpkg), Dotnet (deps.json), Go (go.mod), Java (JAR/WAR/EAR/Maven/Gradle), JavaScript (npm/yarn), PHP (composer), Python (pip/poetry/setup.py), Red Hat (RPM), Ruby (gem), Rust (cargo), Swift (cocoapods) Container & System: OCI images, Docker images, Singularity, container layers, Linux distributions Quick Start Generate SBOM for container image: Core Workflows Workflow 1: Container Image SBOM Generation For creating SBOMs of container images: 1. Identify target container image (local or registry) 2. Run Syft to generate SBOM: 3. Optionally generate multiple formats: 4. Store SBOM artifacts with image for traceability 5. Use SBOM for vulnerability scanning with Grype or other tools 6. Track SBOM versions alongside image releases Workflow 2: CI/CD Pipeline Integration Progress: [ ] 1. Add Syft to build pipeline after image creation [ ] 2. Generate SBOM in standard format (CycloneDX or SPDX) [ ] 3. Store SBOM as build artifact [ ] 4. Scan SBOM for vulnerabilities (using Grype or similar) [ ] 5. Fail build on critical vulnerabilities or license violations [ ] 6. Publish SBOM alongside container image [ ] 7. Integrate with vulnerability management platform Work through each step systematically. Check off completed items. Workflow 3: Filesystem and Application Scanning For generating SBOMs from source code or filesystems: 1. Navigate to project root or specify path 2. Scan directory structure: 3. Review detected packages and dependencies 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/sbom-syft