sbom-generation

仓库创建 2026年7月26日最近提交 3 天前SkillHot 收录 2 天前

这个 Skill 做什么

把软件包的“配料表”列出来——每个依赖、版本和许可证，生成标准格式的 SBOM，方便扫描、追踪或交给审计人员。发布前或遇到漏洞通告时用它，能在几秒钟内回答“我们受影响吗，在哪里”的问题。特别之处是把分散的依赖信息标准化，减少排查和合规的盲区。

▸ 展开 SKILL.md 英文原文

Use when you need a complete inventory of what's inside a build — every dependency and its version — as an SBOM you can scan, track, and hand to auditors.

Stars

Forks

仓库内 Skill

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/09-software-supply-chain-security/01-sbom-generation/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/09-software-supply-chain-security/01-sbom-generation/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## Purpose

You can't defend a supply chain you can't enumerate. A Software Bill of Materials is the ingredient list — every component, version, and licence in an artifact — in a standard format. When the next Log4Shell drops, an SBOM answers "are we affected, and where" in seconds instead of a frantic week. This skill covers generating one and putting it to use.

## When to use it

Generate an SBOM as a build output for anything you ship or run: application artifacts, container images, releases. It underpins vulnerability triage, licence compliance, and incident response, so it's the foundation for most of this domain.

## Procedure

1. Generate the SBOM from the artifact. Syft reads a cont

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有