generating-and-analyzing-sboms skill (Anthropic-Cybersecurity-Skills)
- Install
- SKILL.md (verbatim)
- Overview
- When to Use
- Prerequisites
- Objectives
- MITRE ATT&CK Mapping
- Workflow
- 1. Generate a CycloneDX SBOM from a container image
- 2. Generate an SPDX SBOM from a source directory
- 3. Emit multiple formats at once
- 4. Scan the SBOM for vulnerabilities with Grype
- 5. Gate CI/CD on severity
- 6. Sign and attach the SBOM as an attestation
- 7. Verify the attestation downstream
- 8. Retrieve and re-scan attached SBOMs
- 9. Correlate to vulnerability intelligence
- Tools and Resources
- Format Comparison
- Validation Criteria
- Other files in this skill
- references/api-reference.md (verbatim)
- Syft (SBOM generation)
- Grype (vulnerability scanning)
- Cosign (signing / attestation)
- Policy file (.grype.yaml)
- references/standards.md (verbatim)
- NIST Cybersecurity Framework 2.0
- MITRE ATT&CK
- SBOM Standards and Authorities
- Supporting References
What it does. Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embedding SBOM generation and vulnerability gating into CI/CD. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
| Upstream | mukul975/Anthropic-Cybersecurity-Skills |
| Skill file | skills/generating-and-analyzing-sboms/SKILL.md |
| License | Apache-2.0 (skill folder LICENSE) |
| Author | mukul975 |
| Fetched | 2026-09-10 |
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill generating-and-analyzing-sboms, or copy the skill folder into~/.claude/skills/generating-and-analyzing-sboms/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/generating-and-analyzing-sboms/SKILL.md
SKILL.md (verbatim)
name: generating-and-analyzing-sboms
description: Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embedding SBOM generation and vulnerability gating into CI/CD.
domain: cybersecurity
subdomain: supply-chain-security
tags:
- supply-chain-security
- sbom
- cyclonedx
- spdx
- syft
- grype
- vulnerability-management
- devsecops
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.AM-08
mitre_attack:
- T1195.001
Generating and Analyzing SBOMs
Authorized Use Only: Generate and scan SBOMs only for software and images you own or are authorized to assess. Treat SBOMs as sensitive inventory data — they reveal your dependency attack surface.
Overview
A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of every component, library, and dependency in a piece of software — the supply-chain equivalent of an ingredients label. SBOMs are central to defending against supply-chain compromise (CISA's SBOM initiative, US Executive Order 14028) because you cannot patch what you cannot see. The two dominant SBOM standards are:
- CycloneDX — an OWASP standard optimized for security use cases (vulnerabilities, VEX, dependency relationships).
- SPDX — a Linux Foundation / ISO standard (ISO/IEC 5962) strong on licensing and provenance.
The reference open-source toolchain is from Anchore:
- Syft generates SBOMs (CycloneDX, SPDX, or its native format) from container images and filesystems.
- Grype matches an SBOM (or image) against vulnerability databases to find CVEs.
- Cosign (Sigstore) signs SBOMs and attaches them to images as signed attestations for tamper-evident provenance.
This skill covers producing standards-compliant SBOMs, correlating them with vulnerability intelligence, and embedding the workflow into CI/CD.
When to Use
- Establishing and maintaining a component inventory for applications and container images.
- Continuously detecting known vulnerabilities (including newly disclosed CVEs against existing artifacts).
- Satisfying procurement/regulatory SBOM requirements (CISA, EO 14028).
- Producing signed SBOM attestations for downstream supply-chain trust.
Prerequisites
- Install Syft and Grype (official install scripts):
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin - Install Cosign for signing/attestation:
# via Go, or download a release from https://github.com/sigstore/cosign/releases go install github.com/sigstore/cosign/v2/cmd/cosign@latest - Access to the target images/source and (for signing) a registry plus keys or keyless OIDC.
Objectives
- Generate CycloneDX and SPDX SBOMs from images and directories.
- Scan SBOMs and images for vulnerabilities with Grype.
- Gate CI/CD builds on severity thresholds.
- Sign and attach SBOM attestations with Cosign and verify them.
MITRE ATT&CK Mapping
| ID | Official Technique Name | Relevance to this skill |
|---|---|---|
| T1195.001 | Supply Chain Compromise: Compromise Software Dependencies and Development Tools | SBOM generation and vulnerability correlation expose compromised or vulnerable dependencies — the attack surface adversaries abuse under this technique. |
This is a defensive supply-chain skill; the mapping reflects the adversary technique it is designed to detect and mitigate.
Workflow
1. Generate a CycloneDX SBOM from a container image
-o <format> selects output; cyclonedx-json is security-oriented.
syft alpine:latest -o cyclonedx-json=alpine.cdx.json
2. Generate an SPDX SBOM from a source directory
Use the dir: source to inventory a checked-out repository; spdx-json for the SPDX standard.
syft dir:. -o spdx-json=app.spdx.json
3. Emit multiple formats at once
Produce both standards in a single pass for different consumers.
syft myorg/app:1.4.2 \
-o cyclonedx-json=app.cdx.json \
-o spdx-json=app.spdx.json \
-o table
4. Scan the SBOM for vulnerabilities with Grype
Decoupling generation from scanning lets you re-scan stored SBOMs as new CVEs land — without rebuilding.
# Scan an existing SBOM
grype sbom:app.cdx.json -o table
# JSON report for automation
grype sbom:app.cdx.json -o json > app.vulns.json
You can also scan an image directly (Grype generates the SBOM internally):
grype myorg/app:1.4.2 -o table
5. Gate CI/CD on severity
--fail-on exits non-zero at or above a severity, failing the pipeline.
grype sbom:app.cdx.json --fail-on high
Filter out unfixable noise with a .grype.yaml policy (only-fixed: true) or --only-fixed:
grype sbom:app.cdx.json --only-fixed --fail-on critical
6. Sign and attach the SBOM as an attestation
Cosign records the SBOM as a signed, in-toto attestation alongside the image in the registry.
# Key-based signing
cosign attest --key cosign.key \
--predicate app.spdx.json \
--type spdxjson \
myorg/app:1.4.2
# Keyless (Sigstore OIDC / Fulcio + Rekor)
COSIGN_EXPERIMENTAL=1 cosign attest \
--predicate app.cdx.json \
--type cyclonedx \
myorg/app:1.4.2
7. Verify the attestation downstream
Consumers verify provenance before trusting an image.
cosign verify-attestation --key cosign.pub --type spdxjson myorg/app:1.4.2
8. Retrieve and re-scan attached SBOMs
Pull the attested SBOM from the registry and re-run Grype as part of continuous monitoring.
cosign download attestation myorg/app:1.4.2 \
| jq -r '.payload' | base64 -d | jq '.predicate' > pulled.spdx.json
grype sbom:pulled.spdx.json -o table
9. Correlate to vulnerability intelligence
Feed Grype JSON into your vulnerability management workflow: deduplicate by CVE, enrich with EPSS/KEV for prioritization, and track remediation SLAs. Re-scan stored SBOMs on each Grype DB update to catch newly disclosed CVEs in unchanged artifacts.
Tools and Resources
| Tool | Purpose | Link |
|---|---|---|
| Syft | SBOM generation | https://github.com/anchore/syft |
| Grype | Vulnerability scanning of SBOMs/images | https://github.com/anchore/grype |
| Cosign | SBOM signing/attestation | https://github.com/sigstore/cosign |
| CycloneDX | Security-focused SBOM standard | https://cyclonedx.org/ |
| SPDX | ISO SBOM standard | https://spdx.dev/ |
| CISA SBOM | Guidance and minimum elements | https://www.cisa.gov/sbom |
Format Comparison
| Aspect | CycloneDX | SPDX |
|---|---|---|
| Steward | OWASP | Linux Foundation / ISO 5962 |
| Strength | Security, VEX, vulnerabilities | Licensing, provenance |
Common syft -o values |
cyclonedx-json, cyclonedx-xml |
spdx-json, spdx (tag-value) |
Validation Criteria
- CycloneDX SBOM generated from the target image
- SPDX SBOM generated from source where required
- SBOM scanned with Grype producing a CVE report
- CI/CD gated with
--fail-onat an agreed severity - SBOM signed and attached as an attestation with Cosign
- Attestation verified downstream
- Stored SBOMs re-scanned on Grype DB updates
- Findings correlated/prioritized (EPSS/KEV) and tracked to remediation
Other files in this skill
references/api-reference.md (verbatim)
SBOM Toolchain Command Reference
Syft (SBOM generation)
Source prefixes: <image> (default = container image), dir:<path>, file:<path>,
registry:<image>, docker:<image>, oci-archive:<path>.
| Flag / form | Purpose |
|---|---|
-o <format>[=<file>] |
Output format and optional file |
--scope <squashed|all-layers> |
Layer scope for images |
--exclude <glob> |
Exclude paths |
syft <src> -o table |
Human-readable summary |
Common -o formats: cyclonedx-json, cyclonedx-xml, spdx-json, spdx (tag-value), syft-json, table.
syft alpine:latest -o cyclonedx-json=alpine.cdx.json
syft dir:. -o spdx-json=app.spdx.json
syft myorg/app:1.4.2 -o cyclonedx-json=app.cdx.json -o spdx-json=app.spdx.json -o table
Grype (vulnerability scanning)
Source prefixes: sbom:<file>, <image>, dir:<path>, registry:<image>.
| Flag | Purpose |
|---|---|
-o <format> |
table, json, cyclonedx, sarif |
--fail-on <severity> |
Exit non-zero at/above severity (low|medium|high|critical) |
--only-fixed |
Report only vulns with a fix available |
--add-cpes-if-none |
Improve matching for SBOMs lacking CPEs |
db update |
Update the vulnerability database |
grype sbom:app.cdx.json -o table
grype sbom:app.cdx.json -o json > app.vulns.json
grype sbom:app.cdx.json --only-fixed --fail-on critical
grype myorg/app:1.4.2 -o table
grype db update
Cosign (signing / attestation)
| Command | Purpose |
|---|---|
cosign attest --key <key> --predicate <sbom> --type <type> <image> |
Attach signed SBOM attestation |
cosign verify-attestation --key <pub> --type <type> <image> |
Verify attestation |
cosign download attestation <image> |
Retrieve attached attestation |
cosign generate-key-pair |
Create signing keys |
--type values: spdxjson, cyclonedx, slsaprovenance, or a custom URI.
Keyless mode: set COSIGN_EXPERIMENTAL=1 and omit --key (uses Fulcio/Rekor).
cosign attest --key cosign.key --predicate app.spdx.json --type spdxjson myorg/app:1.4.2
cosign verify-attestation --key cosign.pub --type spdxjson myorg/app:1.4.2
cosign download attestation myorg/app:1.4.2
Policy file (.grype.yaml)
only-fixed: true
fail-on-severity: high
ignore:
- vulnerability: CVE-2024-0000 # documented, risk-accepted
references/standards.md (verbatim)
Standards and Framework Mapping — Generating and Analyzing SBOMs
NIST Cybersecurity Framework 2.0
| ID | Name | Rationale |
|---|---|---|
| ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | SBOMs are the authoritative software-component inventory that underpins lifecycle asset management and supply-chain risk visibility. |
MITRE ATT&CK
| ID | Name | Rationale |
|---|---|---|
| T1195.001 | Supply Chain Compromise: Compromise Software Dependencies and Development Tools | SBOM generation plus vulnerability correlation surfaces vulnerable/compromised dependencies, directly countering this technique. |
SBOM Standards and Authorities
| Standard / Authority | Role |
|---|---|
| CycloneDX (OWASP) | Security-focused SBOM format (VEX, vulnerabilities) |
| SPDX (ISO/IEC 5962) | Licensing/provenance-focused SBOM format |
| CISA SBOM Minimum Elements | Baseline required SBOM fields |
| US Executive Order 14028 | Mandates SBOMs for software sold to the US government |
| NTIA "Framing Software Component Transparency" | Foundational SBOM guidance |
Supporting References
- CISA SBOM: https://www.cisa.gov/sbom
- CycloneDX: https://cyclonedx.org/
- SPDX: https://spdx.dev/
- Syft: https://github.com/anchore/syft
- Grype: https://github.com/anchore/grype
- Sigstore Cosign: https://github.com/sigstore/cosign
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.