| name | sbom-generate |
| description | Generate CycloneDX 1.7 and/or SPDX 2.3 SBOMs for the repo, optionally cosign-signed, optionally cross-validated against syft output. Use when producing an SBOM for compliance, attaching to a release artefact, integrating with an SBOM registry, or satisfying a customer attestation request. |
| argument-hint | [--format cyclonedx|spdx|both] [--sign] [--output PATH] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["sbom","cyclonedx","spdx","generate sbom"] |
| chain | ["compliance-report","vex-publish"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix SBOM Generate Skill
Use when
- Producing an SBOM for SOC 2 / supply-chain compliance.
- Attaching an SBOM to a release artefact (GitHub release, container registry).
- Submitting to an SBOM registry (e.g. NTIA, in-house).
- Cosign signing for keyless OIDC supply-chain attestation.
- Cross-validating Vulnetix output against syft for component-count drift.
Don't use for
- Just the license list — use
/vulnetix:license-check.
- Full compliance bundle (SBOM + VEX + SARIF) — use
/vulnetix:compliance-report.
- Container-image SBOM — use
/vulnetix:container-scan with syft composition.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Step 1: Load capabilities
Read .vulnetix/capabilities.yaml. Use binaries.cosign to gate signing. If user asks for --sign without cosign, surface install hint and skip signing.
Step 2: Generate
OUT="${OUTPUT_DIR:-.vulnetix/sboms/$(date -u +%Y%m%dT%H%M%SZ)}"
mkdir -p "$OUT"
if [[ "$FORMAT" == "cyclonedx" ]] || [[ "$FORMAT" == "both" ]]; then
vulnetix scan -o json-cyclonedx > "$OUT/sbom.cdx.json"
fi
if [[ "" == ]] || [[ == ]];
vulnetix license -o json-spdx >
