Skip to main content Home Creators agentsecops secopsagentkit sbom-syft
sbom-syft Software Bill of Materials (SBOM) generation using Syft for container images, filesystems, and archives. Detects packages across 28+ ecosystems with multi-format output support (CycloneDX, SPDX, syft-json). Enables vulnerability assessment, license compliance, and supply chain security. Use when: (1) Generating SBOMs for container images or applications, (2) Analyzing software dependencies and packages for vulnerability scanning, (3) Tracking license compliance across dependencies, (4) Integrating SBOM generation into CI/CD for supply chain security, (5) Creating signed SBOM attestations for software provenance.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/AgentSecOps/SecOpsAgentKit --skill sbom-syftThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository Interactive HTTPS proxy for API security testing with traffic interception, modification, and replay capabilities. Supports HTTP/1, HTTP/2, HTTP/3, WebSockets, and TLS-protected protocols. Includes Python scripting API for automation and multiple interfaces (console, web, CLI). Use when: (1) Intercepting and analyzing API traffic for security testing, (2) Modifying HTTP/HTTPS requests and responses to test API behavior, (3) Recording and replaying API traffic for testing, (4) Debugging mobile app or thick client API communications, (5) Automating API security tests with Python scripts, (6) Exporting traffic in HAR format for analysis.
API specification linting and security validation using Stoplight's Spectral with support for OpenAPI, AsyncAPI, and Arazzo specifications. Validates API definitions against security best practices, OWASP API Security Top 10, and custom organizational standards. Use when: (1) Validating OpenAPI/AsyncAPI specifications for security issues and design flaws, (2) Enforcing API design standards and governance policies across API portfolios, (3) Creating custom security rules for API specifications in CI/CD pipelines, (4) Detecting authentication, authorization, and data exposure issues in API definitions, (5) Ensuring API specifications comply with organizational security standards and regulatory requirements.
Fast web fuzzer for DAST testing with directory enumeration, parameter fuzzing, and virtual host discovery. Written in Go for high-performance HTTP fuzzing with extensive filtering capabilities. Supports multiple fuzzing modes (clusterbomb, pitchfork, sniper) and recursive scanning. Use when: (1) Discovering hidden directories, files, and endpoints on web applications, (2) Fuzzing GET and POST parameters to identify injection vulnerabilities, (3) Enumerating virtual hosts and subdomains, (4) Testing authentication endpoints with credential fuzzing, (5) Finding backup files and sensitive data exposures, (6) Performing comprehensive web application reconnaissance.
Related occupations SOC
Based on SOC occupation classification
name sbom-syft description Software Bill of Materials (SBOM) generation using Syft for container images, filesystems, and archives. Detects packages across 28+ ecosystems with multi-format output support (CycloneDX, SPDX, syft-json). Enables vulnerability assessment, license compliance, and supply chain security. Use when: (1) Generating SBOMs for container images or applications, (2) Analyzing software dependencies and packages for vulnerability scanning, (3) Tracking license compliance across dependencies, (4) Integrating SBOM generation into CI/CD for supply chain security, (5) Creating signed SBOM attestations for software provenance.
version 0.1.0 maintainer SirAppSec category secsdlc tags ["sbom","syft","supply-chain","dependencies","cyclonedx","spdx","vulnerability-management","license-compliance"] frameworks ["NIST","OWASP"] dependencies {"tools":["docker"]} references ["https://github.com/anchore/syft","https://anchore.com/sbom/"]
Syft SBOM Generator
Overview
Syft is a CLI tool and Go library for generating comprehensive Software Bills of Materials (SBOMs) from container images and filesystems. It provides visibility into packages and dependencies across 28+ ecosystems, supporting multiple SBOM formats (CycloneDX, SPDX) for vulnerability management, license compliance, and supply chain security.
Supported Ecosystems
Languages & Package Managers:
Alpine (apk), C/C++ (conan), Dart (pub), Debian/Ubuntu (dpkg), Dotnet (deps.json), Go (go.mod), Java (JAR/WAR/EAR/Maven/Gradle), JavaScript (npm/yarn), PHP (composer), Python (pip/poetry/setup.py), Red Hat (RPM), Ruby (gem), Rust (cargo), Swift (cocoapods)
Container & System:
OCI images, Docker images, Singularity, container layers, Linux distributions
Quick Start
Generate SBOM for container image:
docker run --rm -v $(pwd ):/out anchore/syft:latest <image> -o cyclonedx-json=/out/sbom.json
syft <image> -o cyclonedx-json=sbom.json
syft alpine:latest -o cyclonedx-json
syft docker.io/nginx:latest -o spdx-json
syft dir :/path/to/project -o cyclonedx-json
Core Workflows
Workflow 1: Container Image SBOM Generation
For creating SBOMs of container images:
Identify target container image (local or registry)
Run Syft to generate SBOM:
syft <image-name:tag> -o cyclonedx-json=sbom-cyclonedx.json
Optionally generate multiple formats:
syft <image-name:tag> \
-o cyclonedx-json=sbom-cyclonedx.json \
-o spdx-json=sbom-spdx.json \
-o syft-json=sbom-syft.json
Store SBOM artifacts with image for traceability
Use SBOM for vulnerability scanning with Grype or other tools
Track SBOM versions alongside image releases
Workflow 2: CI/CD Pipeline Integration
Progress:
[ ] 1. Add Syft to build pipeline after image creation
[ ] 2. Generate SBOM in standard format (CycloneDX or SPDX)
[ ] 3. Store SBOM as build artifact
[ ] 4. Scan SBOM for vulnerabilities (using Grype or similar)
[ ] 5. Fail build on critical vulnerabilities or license violations
[ ] 6. Publish SBOM alongside container image
[ ] 7. Integrate with vulnerability management platform
Work through each step systematically. Check off completed items.
Workflow 3: Filesystem and Application Scanning
For generating SBOMs from source code or filesystems:
Navigate to project root or specify path
Scan directory structure:
syft dir :/path/to/project -o cyclonedx-json=app-sbom.json
Review detected packages and dependencies
Validate package detection accuracy (check for false positives/negatives)
Configure exclusions if needed (using .syft.yaml)
Generate SBOM for each release version
Track dependency changes between versions
Workflow 4: SBOM Analysis and Vulnerability Scanning Combining SBOM generation with vulnerability assessment:
Generate SBOM with Syft:
syft <target> -o cyclonedx-json=sbom.json
Scan SBOM for vulnerabilities using Grype:
grype sbom:sbom.json -o json --file vulnerabilities.json
Review vulnerability findings by severity
Filter by exploitability and fix availability
Prioritize remediation based on:
CVSS score
Active exploitation status
Fix availability
Dependency depth
Update dependencies and regenerate SBOM
Re-scan to verify vulnerability remediation
Workflow 5: Signed SBOM Attestation For creating cryptographically signed SBOM attestations:
Install cosign (for signing):
brew install cosign
wget https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
chmod +x cosign-linux-amd64
mv cosign-linux-amd64 /usr/local/bin/cosign
Generate SBOM:
syft <image> -o cyclonedx-json=sbom.json
Create attestation and sign:
cosign attest --predicate sbom.json --type cyclonedx <image>
Verify attestation:
cosign verify-attestation --type cyclonedx <image>
Store signature alongside SBOM for provenance verification
Output Formats Syft supports multiple SBOM formats for different use cases:
Format Use Case Specification cyclonedx-jsonModern SBOM standard, wide tool support CycloneDX 1.4+ cyclonedx-xmlCycloneDX XML variant CycloneDX 1.4+ spdx-jsonLinux Foundation standard SPDX 2.3 spdx-tag-valueSPDX text format SPDX 2.3 syft-jsonSyft native format (most detail) Syft-specific syft-textHuman-readable console output Syft-specific github-jsonGitHub dependency submission GitHub-specific templateCustom Go template output User-defined
syft <target> -o cyclonedx-json=output.json
Configuration Create .syft.yaml in project root or home directory:
package:
cataloger:
enabled: true
scope: all-layers
search:
unindexed-archives: false
indexed-archives: true
exclude:
- "**/test/**"
- "**/node_modules/**"
- "**/.git/**"
registry:
insecure-skip-tls-verify: false
auth:
- authority: registry.example.com
username: user
password: pass
output: cyclonedx-json
log:
level: warn
Common Patterns
Pattern 1: Multi-Architecture Image Scanning Scan all architectures of multi-platform images:
syft --platform linux/amd64 <image> -o cyclonedx-json=sbom-amd64.json
syft --platform linux/arm64 <image> -o cyclonedx-json=sbom-arm64.json
syft <image> --platform all -o cyclonedx-json
Pattern 2: Private Registry Authentication Access images from private registries:
docker login registry.example.com
syft registry.example.com/private/image:tag -o cyclonedx-json
export SYFT_REGISTRY_AUTH_AUTHORITY=registry.example.com
export SYFT_REGISTRY_AUTH_USERNAME=user
export SYFT_REGISTRY_AUTH_PASSWORD=pass
syft registry.example.com/private/image:tag -o cyclonedx-json
Pattern 3: OCI Archive Scanning Scan saved container images (OCI or Docker format):
docker save nginx:latest -o nginx.tar
syft oci-archive:nginx.tar -o cyclonedx-json=sbom.json
syft docker-archive:nginx.tar -o cyclonedx-json=sbom.json
Pattern 4: Comparing SBOMs Between Versions Track dependency changes across releases:
syft myapp:v1.0 -o syft-json=sbom-v1.0.json
syft myapp:v2.0 -o syft-json=sbom-v2.0.json
jq -s '{"added": (.[1].artifacts - .[0].artifacts), "removed": (.[0].artifacts - .[1].artifacts)}' \
sbom-v1.0.json sbom-v2.0.json
Pattern 5: Filtering SBOM Output Extract specific package information:
syft <target> -o syft-json=full-sbom.json
cat full-sbom.json | jq '.artifacts[] | select(.type == "python")'
cat full-sbom.json | jq '.artifacts[] | select(.licenses[].value == "MIT")'
cat full-sbom.json | jq '.artifacts | group_by(.type) | map({type: .[0].type, count: length})'
Security Considerations
Sensitive Data Handling : SBOMs may contain internal package names and versions. Store SBOMs securely and restrict access to authorized personnelAccess Control : Limit SBOM generation and access to build systems. Use read-only credentials for registry accessAudit Logging : Log SBOM generation events, distribution, and access for compliance trackingCompliance : SBOMs support compliance with Executive Order 14028 (Software Supply Chain Security), NIST guidelines, and OWASP recommendationsSafe Defaults : Use signed attestations for production SBOMs to ensure integrity and provenance
Integration Points
CI/CD Integration - name: Generate SBOM with Syft
uses: anchore/sbom-action@v0
with:
image: ${{ env.IMAGE_NAME }}:${{ github.sha }}
format: cyclonedx-json
output-file: sbom.json
- name: Upload SBOM
uses: actions/upload-artifact@v3
with:
name: sbom
path: sbom.json
sbom-generation:
image: anchore/syft:latest
script:
- syft $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -o cyclonedx-json=sbom.json
artifacts:
reports:
cyclonedx: sbom.json
stage('Generate SBOM') {
steps {
sh 'syft ${IMAGE_NAME}:${BUILD_NUMBER} -o cyclonedx-json=sbom.json'
archiveArtifacts artifacts: 'sbom.json'
}
}
Vulnerability Scanning Integrate with Grype for vulnerability scanning:
syft <target> -o cyclonedx-json=sbom.json
grype sbom:sbom.json
SBOM Distribution Attach SBOMs to container images:
oras attach <image> --artifact-type application/vnd.cyclonedx+json sbom.json
Advanced Usage
Custom Template Output Create custom output formats using Go templates:
cat > custom-template.tmpl <<'EOF'
{{- range .Artifacts}}
{{.Name}}@{{.Version}} ({{.Type}})
{{- end}}
EOF
syft <target> -o template -t custom-template.tmpl
Scanning Specific Layers Analyze specific layers in container images:
syft <image> --scope squashed -o cyclonedx-json
syft <image> --scope all-layers -o cyclonedx-json
Environment Variable Configuration Configure Syft via environment variables:
export SYFT_SCOPE=all-layers
export SYFT_OUTPUT=cyclonedx-json
export SYFT_LOG_LEVEL=debug
export SYFT_EXCLUDE="**/test/**,**/node_modules/**"
syft <target>
Troubleshooting
Issue: Missing Packages in SBOM Solution : Enable all-layers scope or check for package manager files:
syft <target> --scope all-layers -o syft-json
Verify package manifest files exist (package.json, requirements.txt, go.mod, etc.)
Issue: Registry Authentication Failure Solution : Ensure Docker credentials are configured or use explicit auth:
docker login <registry>
syft <registry>/<image> -o cyclonedx-json
Issue: Large SBOM Size Solution : Use squashed scope and exclude test/dev dependencies:
package:
cataloger:
scope: squashed
exclude:
- "**/test/**"
- "**/node_modules/**"
- "**/.git/**"
Issue: Slow Scanning Performance Solution : Disable unindexed archive scanning for faster results:
package:
search:
unindexed-archives: false
License Compliance Extract license information from SBOM:
syft <target> -o syft-json=sbom.json
cat sbom.json | jq -r '.artifacts[].licenses[].value' | sort -u
cat sbom.json | jq '.artifacts[] | select(.licenses[].value | contains("GPL"))'
cat sbom.json | jq -r '.artifacts[] | "\(.name):\(.licenses[].value)"' | sort
Vulnerability Management Workflow Complete workflow integrating SBOM generation with vulnerability management:
Progress:
[ ] 1. Generate SBOM for application/container
[ ] 2. Scan SBOM for known vulnerabilities
[ ] 3. Classify vulnerabilities by severity and exploitability
[ ] 4. Check for available patches and updates
[ ] 5. Update vulnerable dependencies
[ ] 6. Regenerate SBOM after updates
[ ] 7. Re-scan to confirm vulnerability remediation
[ ] 8. Document accepted risks for unfixable vulnerabilities
[ ] 9. Schedule periodic SBOM regeneration and scanning
Work through each step systematically. Check off completed items.
References 