Software Bill of Materials (SBOM) security analysis for vulnerability assessment and third-party
risk management. Validates SBOMs from vendors or generates SBOMs for internal projects. Use this skill when:
- User asks to analyze an SBOM file
- User mentions "third-party risk" or "vendor security"
- User needs to validate a supplier's SBOM
- User wants to check SBOM for vulnerabilities
- User asks about CycloneDX or SPDX formats
Software Bill of Materials (SBOM) security analysis for vulnerability assessment and third-party
risk management. Validates SBOMs from vendors or generates SBOMs for internal projects. Use this skill when:
- User asks to analyze an SBOM file
- User mentions "third-party risk" or "vendor security"
- User needs to validate a supplier's SBOM
- User wants to check SBOM for vulnerabilities
- User asks about CycloneDX or SPDX formats
allowed-tools
mcp_snyk_snyk_sbom_scan Read Write Bash Grep
license
Apache-2.0
compatibility
Requires Snyk MCP server connection and authenticated Snyk account.
SBOM must be in CycloneDX (1.4-1.6) or SPDX (2.3) JSON format.
Components must include Package URLs (purls) for vulnerability identification.
metadata
{"author":"Snyk","version":"1.0.0"}
SBOM Security Analyzer
Analyze Software Bill of Materials to identify vulnerabilities in declared components for third-party risk management and compliance workflows.
Core Principle: Know what's in your software supply chain.
Quick Start
1. Receive or locate SBOM file (CycloneDX or SPDX)
2. Validate SBOM format and completeness
3. Run mcp_snyk_snyk_sbom_scan for vulnerability analysis
4. Generate risk report with prioritized findings
5. Provide remediation guidance
Supported SBOM Formats
Format
Versions
File Extension
CycloneDX
1.4, 1.5, 1.6
.json
SPDX
2.3
.json
Note: mcp_snyk_snyk_sbom_scan requires Package URLs (purls) in the SBOM for component identification.
Phase 1: SBOM Validation
Goal: Ensure the SBOM is valid and complete before analysis.
Draft a message to the vendor using this template (populate with actual findings):
Subject: Security Vulnerabilities in Software SBOM
Dear [Vendor],
During our security review of [Product Name], we identified the following
vulnerabilities in the provided SBOM:
**Critical Issues (Require Immediate Action)**:
1. [Component] [Version] - [CVE] ([Name])
2. [Component] [Version] - [CVE] ([Name])
**Request**:
1. Provide updated software with patched versions
2. Provide updated SBOM reflecting the changes
3. Confirm expected remediation timeline
We require resolution of critical issues before proceeding with integration.
Regards,
[Your Name]
SBOM Generation (Internal Projects)
To generate an SBOM for your own project using the Snyk CLI, then scan it:
Error: Unable to parse SBOM file
Solutions:
1. Verify file is valid JSON
2. Check SBOM format (CycloneDX/SPDX)
3. Validate against schema
4. Request corrected SBOM from source
Missing Package URLs
Warning: X components missing purl - cannot scan
Solutions:
1. Request updated SBOM with purls
2. Manually add purls if components are known
3. Document risk of unscanned components
Unsupported Version
Error: SBOM version not supported
Supported versions:
- CycloneDX: 1.4, 1.5, 1.6
- SPDX: 2.3
Convert SBOM to supported version if possible.
Constraints
Requires purls: Components without package URLs cannot be scanned
JSON only: XML format not currently supported
Version limits: Only specific CycloneDX/SPDX versions supported
