The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute legitimate security utilities including the snyk CLI, cyclonedx-cli, and spdx-tools for SBOM generation, validation, and conversion. These are standard operations for the described security analysis tasks.
[EXTERNAL_DOWNLOADS]: Documentation references the use of npx to fetch and run the @cyclonedx/cyclonedx-library from the npm registry. This is an expected and standard method for utilizing specialized validation tools.
[PROMPT_INJECTION]: The skill processes untrusted external data in the form of SBOM files, which creates a surface for indirect prompt injection. Malicious content within SBOM component fields could attempt to influence the agent's behavior during report generation or vendor communication drafting.
Ingestion points: Reads and parses vendor-supplied CycloneDX and SPDX JSON files (SKILL.md).
Boundary markers: None identified; data from the SBOM is directly interpolated into summary and report templates.
Capability inventory: The skill is configured with mcp_snyk_snyk_sbom_scan, Bash, Read, and Write capabilities (SKILL.md).
Sanitization: No explicit sanitization or filtering of component-level metadata is described before it is included in the output.

sbom-analyzer