sbom-syft
SBOM Generation with Syft
You are a security engineer generating Software Bills of Materials (SBOMs) using Syft (Anchore) for supply chain visibility and compliance.
When to use
Use this skill when asked to generate an SBOM, inventory dependencies, or prepare for supply chain compliance (EO 14028, SLSA, etc.).
Prerequisites
- Syft installed (
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin) - Verify:
syft version
Instructions
-
Identify the target — Determine the directory or container image.
-
Generate the SBOM:
Filesystem:
syft dir:<target-path> -o cyclonedx-json > sbom-cyclonedx.jsonContainer image:
syft <image>:<tag> -o spdx-json > sbom-spdx.json- CycloneDX format:
-o cyclonedx-json - SPDX format:
-o spdx-json - Table format (human-readable):
-o table - Multiple outputs:
-o cyclonedx-json=sbom.cdx.json -o spdx-json=sbom.spdx.json
- CycloneDX format:
-
Analyze the SBOM — Present a summary:
| # | Package | Version | Type | License | Ecosystem |
|---|---------|---------|------|---------|-----------|
- Summarize — Provide:
- Total packages by ecosystem (npm, pip, go, etc.)
- License distribution
- Packages without version pins (supply chain risk)
- Recommendation: pipe SBOM to Grype for vulnerability scanning
SBOM Formats
| Format | Standard | Use Case |
|---|---|---|
cyclonedx-json |
OWASP CycloneDX | Most tool-compatible, rich metadata |
spdx-json |
Linux Foundation SPDX | Government/regulatory compliance |
table |
Human-readable | Quick review |
json |
Syft native | Syft-specific toolchain |
More from vchirrav/product-security-ai-skills
network-scan-nmap
Run Nmap for network discovery and security auditing. Performs port scanning, service detection, OS fingerprinting, and vulnerability script scanning.
34dast-nuclei
Run Nuclei template-based vulnerability scanner. Uses 8000+ community templates to detect CVEs, misconfigurations, exposures, and default credentials on web targets.
17malware-scan-yara
Run YARA rules for pattern-based malware identification. Scans files and directories against community and custom rule sets to detect malicious indicators.
14dast-zap
Run OWASP ZAP for Dynamic Application Security Testing. Performs baseline, full, or API scans against running web applications to find XSS, SQLi, CSRF, and other runtime vulnerabilities.
8api-security-spectral
Run Spectral to lint OpenAPI and AsyncAPI specs for security issues. Validates API design for authentication, authorization, rate limiting, and input validation patterns.
7secure-coding-audit
Audit code for security vulnerabilities using OWASP Secure Coding rules. Automatically detects the security domain (auth, API, Docker, K8s, CI/CD, etc.) and validates against the relevant checklist rules, citing specific Rule IDs.
7