grype-syft-sbom-scanner

name	grype-syft-sbom-scanner
description	用于通过 Syft 生成 SBOM，并用 Grype 扫描容器镜像、文件系统、软件包、归档和 SBOM 漏洞。
zh_description	用于通过 Syft 生成 SBOM，并用 Grype 扫描容器镜像、文件系统、软件包、归档和 SBOM 漏洞。
version	1.0.0
author	seaworld008
source	in-house
source_url
tags	[security, sbom, vulnerability-scanning, grype, syft, container-security, supply-chain, cve]
created_at	2026-05-20
updated_at	2026-05-20
quality	4
complexity	advanced

Grype + Syft SBOM Scanner

Trigger / When to Use

Use this skill when the user wants SBOM-first vulnerability management, container image scanning, package inventory, or repeatable vulnerability scans using Anchore open-source tools Syft and Grype.

Good trigger phrases:

• "generate an SBOM and scan it"
• "scan this container with Grype"
• "compare vulnerabilities between two images"
• "produce CycloneDX or SPDX"
• "scan a directory or archive for CVEs"
• "make vulnerability results reproducible from SBOM"

Core Capabilities

• Generate SBOMs from container images, directories, files, archives, and package metadata with Syft.
• Scan container images, directories, SBOMs, and individual package identifiers with Grype.
• Separate inventory generation from vulnerability matching for repeatable audits.
• Compare scan results over time as vulnerability databases change.
• Integrate SBOM and vulnerability outputs into CI/CD and release evidence.
• Support SPDX, CycloneDX, and Syft JSON workflows.

Workflow

1. Pick the SBOM Strategy

Use one of these modes:

• Direct Grype scan for quick triage.
• Syft SBOM plus Grype scan for reproducibility.
• Stored SBOM scan for release, compliance, or incident response.

Prefer SBOM-first when the result will be attached to a release, shared with customers, or compared later.

2. Verify Tools

syft version
grype version

If missing, install from official Anchore channels. Pin versions in CI when release evidence matters.

3. Generate an SBOM

For a container image:

syft registry.example.com/app:1.2.3 -o cyclonedx-json=sbom.cdx.json

For a local source or filesystem directory:

syft dir:. -o spdx-json=sbom.spdx.json

For Syft JSON:

syft packages . -o syft-json=sbom.syft.json

4. Scan with Grype

Scan an image directly:

grype registry.example.com/app:1.2.3

Scan a directory:

grype dir:.

Scan an SBOM:

grype sbom:sbom.cdx.json