compliance-report

name	compliance-report
description	Build a compliance bundle — CycloneDX SBOM, SPDX license report, SARIF findings, OpenVEX/CycloneDX VEX, optional cosign signatures, manifest.json with SHA-256 sums, Markdown index. Use when assembling an audit bundle, SOC 2 attestation, supply-chain compliance package, or evidence for a customer security questionnaire.
argument-hint	[--sign] [--output-dir .vulnetix/compliance/]
user-invocable	true
allowed-tools	Bash, Read, Glob, Grep, Edit, Write
model	sonnet
triggers	["compliance","audit report","attestation","sbom bundle"]
chain	["sbom-generate","vex-publish"]
outputBudget	medium
cooldown	per-session

Vulnetix Compliance Report Skill

Use when

• Assembling an audit bundle for SOC 2, ISO 27001, or FedRAMP.
• Supply-chain compliance: producing CycloneDX SBOM + VEX + SARIF in one delivery.
• Evidence for a customer security questionnaire that asks for SBOM + signed attestations.
• Pre-release: assembling the security artefacts that ship alongside the release.
• Quarterly compliance review: regenerating the full bundle for archive.

Don't use for

• Just generating an SBOM — use /vulnetix:sbom-generate.
• Per-CVE VEX statements — use /vulnetix:vex-publish (this skill composes it).
• Single-scanner output — use the individual /vulnetix:sast-scan, /vulnetix:secret-scan, etc.

Conventions

This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.

Produces a bundle suitable for audit / attestation submission.

Step 1: Load capabilities

Read .vulnetix/capabilities.yaml. Use binaries.cosign to gate the --sign step.

Step 2: Generate artifacts in parallel

OUT="${OUTPUT_DIR:-.vulnetix/compliance/$(date -u +%Y%m%dT%H%M%SZ)}"
mkdir -p "$OUT"

vulnetix scan -o json-cyclonedx > "$OUT/sbom.cdx.json" &
vulnetix license -o json-spdx > "$OUT/licenses.spdx.json" &
vulnetix scan --evaluate-sast -o json-sarif > "$OUT/findings.sarif" &
wait

Step 3: Generate VEX (uses local memory.yaml)

vulnetix triage --provider vulnetix --vex-format cyclonedx -o json > "$OUT/vex.cdx.json"

Step 4: Sign (conditional)

If --sign and binaries.cosign: true:

cosign sign-blob --yes "$OUT/sbom.cdx.json" --bundle "$OUT/sbom.cdx.json.sig.bundle"
cosign sign-blob --yes "$OUT/findings.sarif" --bundle "$OUT/findings.sarif.sig.bundle"

If cosign absent and user requested --sign, surface install hint and continue without signatures.

Step 5: Manifest

Write $OUT/manifest.json listing all artifacts with sha256 sums. Render Markdown index $OUT/README.md.

Step 6: Render report

Compliance bundle: <path>
- SBOM (CycloneDX): <path/size/component count>
- Licenses (SPDX): <path/license count/conflict count>
- Findings (SARIF): <path/critical/high/medium count>
- VEX (CycloneDX): <path/statement count>
- Signed: <yes|no>  (cosign: <available|missing>)

Suggest next: /vulnetix:vex-publish --upload for VEX submission, or supply the path to your audit pipeline.

Edge cases & gotchas

• Four parallel CLI calls (scan -o json-cyclonedx, license -o json-spdx, scan --evaluate-sast -o json-sarif, triage --vex-format cyclonedx). Stagger if rate-limited.
• Cosign signing requires keyless OIDC identity (Fulcio); local devs without an OIDC identity must use --key file:cosign.key.
• Output directory is .vulnetix/compliance/<ISO8601>/; multiple invocations create siblings, never overwrite.
• Optional --upload sends VEX to Vulnetix; SBOM/SARIF/SPDX stay local unless --upload-all is passed.
• Manifest.json SHA-256 sums are computed AFTER signing — re-verify with sha256sum -c manifest.json before archive.
• For repos with no manifest files, scan -o json-cyclonedx produces a near-empty SBOM. Check components count before publishing.