Run any Skill in Manus with one click

ns-generate-sbom

Stars3

Forks0

UpdatedJune 30, 2026 at 12:18

Generates a Software Bill of Materials (SBOM) for a connected or registered N|Solid Node.js app. Use when the user asks for SBOM, software bill of materials, compliance evidence, SOC2/vendor review, license inventory, dependency inventory, or transitive package report for a running application.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

nodesource

nodesource/nsolid-plugin

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

SKILL.md

readonly

name	ns-generate-sbom
description	Generates a Software Bill of Materials (SBOM) for a connected or registered N\|Solid Node.js app. Use when the user asks for SBOM, software bill of materials, compliance evidence, SOC2/vendor review, license inventory, dependency inventory, or transitive package report for a running application.

Instructions

1. Identify Target Application

Determine the specific app name you need the SBOM for.
If the app name is unknown, call information-dashboard (no parameters) to list all connected agents and their app names.
Do NOT use global-filter — it returns ~18,000 tokens and is wasteful for a simple app name lookup.

2. Determine Format Requirement

The sbom tool's format parameter accepts only "json" or "html". It does not support XML.
If the user does not specify a format, default to "html" (human-readable compliance report).
Use "json" only when the user explicitly wants programmatic/machine analysis (e.g. feeding it to another tool).

3. Generate SBOM

Call the sbom tool with the app parameter and format set to "html" (default) or "json".

4. Handle Execution Edge Cases

Timeout warning: Generating an SBOM traverses the entire transitive dependency tree of a live process. The N|Solid server extends the timeout to 180 seconds.
If your MCP client drops the connection at 60s, inform the user the server is still processing, or suggest adjusting their MCP client timeout. Do not retry immediately.

5. Provide Output

If the user asked to download the SBOM, write it directly to the .nsolid/sbom/ folder (create the folder if it does not exist):
- HTML: .nsolid/sbom/<appName>_sbom.html
- JSON: .nsolid/sbom/<appName>_sbom.json
Do not stage the output in a temporary file or /tmp — write straight to .nsolid/sbom/.
Give the user a high-level summary (total packages, top licenses, notable dependencies) and the saved path.

Guardrails

DO NOT pass format: "xml" — XML is not supported. Only "json" or "html"; default to "html".
DO NOT poll or aggressively retry the SBOM endpoint if it times out — it is computationally expensive.
DO NOT hallucinate dependencies. Only report what is strictly inside the returned SBOM.

More from this repository

same repository

ns-advanced-memory-leak-hunter

nodesource/nsolid-plugin

Performs an advanced N|Solid memory leak hunt comparing baseline vs peak heap evidence to isolate retained constructors, closures, and retainer paths. Use when the user reports recurring/staircase memory growth, elusive leaks, retained objects, closures holding references, or a standard heap sample/snapshot analysis was inconclusive. Prefer supplied baseline/peak assets; capture new samples only when needed.

2026-06-303

ns-analyze-asset

nodesource/nsolid-plugin

Analyzes an existing N|Solid diagnostic asset by asset ID or local asset path using asset-summary. Use when the user asks to inspect, review, summarize, or interpret an already-captured CPU profile, heap profile, heap sample, or heap snapshot, including assets just produced by ns-generate-asset. Do not use to capture new profiles/snapshots.

2026-06-303

ns-cpu-spike-analysis

nodesource/nsolid-plugin

Diagnoses high CPU or slow execution in a Node.js app using supplied evidence or N|Solid CPU metrics/profiles. Use when the user reports CPU spike, high CPU percent, slow endpoint/function, event loop blocking, flamegraph/profile analysis, hot loop, or asks why an app is slow. Prefer existing asset IDs, summaries, trace data, or local profiles before capturing a new profile.

2026-06-303

ns-generate-asset

nodesource/nsolid-plugin

Captures a new N|Solid diagnostic asset for a connected Node.js app. Use when the user explicitly asks to collect, capture, or generate a CPU profile, flamegraph, heap sample, heap snapshot, or heap tracking asset and wants it saved or handed off for analysis. For existing assets, use ns-analyze-asset instead.

2026-06-303

ns-memory-spike-analysis

nodesource/nsolid-plugin

Diagnoses memory growth, heap spikes, RSS increases, OOMs, and suspected leaks in Node.js apps using supplied heap evidence or N|Solid heap sampling/snapshots. Use when the user reports memory leak, heap growing, high RSS, out-of-memory, heap snapshot/profile analysis, or wants memory root-cause triage.

2026-06-303

ns-analyze-tracing

nodesource/nsolid-plugin

Analyzes N|Solid/OpenTelemetry tracing evidence for request latency, HTTP errors, and service dependencies. Use when the user asks about slow endpoints, API timeouts, distributed traces/spans, N+1 queries, await chains, microservice latency, cascading failures, or trace IDs. Query N|Solid only when no trace data was provided. Do not assume full waterfall details unless supplied.

2026-06-303

name	ns-generate-sbom
description	Generates a Software Bill of Materials (SBOM) for a connected or registered N\|Solid Node.js app. Use when the user asks for SBOM, software bill of materials, compliance evidence, SOC2/vendor review, license inventory, dependency inventory, or transitive package report for a running application.

Instructions

1. Identify Target Application

Determine the specific app name you need the SBOM for.
If the app name is unknown, call information-dashboard (no parameters) to list all connected agents and their app names.
Do NOT use global-filter — it returns ~18,000 tokens and is wasteful for a simple app name lookup.

2. Determine Format Requirement

The sbom tool's format parameter accepts only "json" or "html". It does not support XML.
If the user does not specify a format, default to "html" (human-readable compliance report).
Use "json" only when the user explicitly wants programmatic/machine analysis (e.g. feeding it to another tool).

3. Generate SBOM

Call the sbom tool with the app parameter and format set to "html" (default) or "json".

4. Handle Execution Edge Cases

Timeout warning: Generating an SBOM traverses the entire transitive dependency tree of a live process. The N|Solid server extends the timeout to 180 seconds.
If your MCP client drops the connection at 60s, inform the user the server is still processing, or suggest adjusting their MCP client timeout. Do not retry immediately.

5. Provide Output

If the user asked to download the SBOM, write it directly to the .nsolid/sbom/ folder (create the folder if it does not exist):
- HTML: .nsolid/sbom/<appName>_sbom.html
- JSON: .nsolid/sbom/<appName>_sbom.json
Do not stage the output in a temporary file or /tmp — write straight to .nsolid/sbom/.
Give the user a high-level summary (total packages, top licenses, notable dependencies) and the saved path.

Guardrails

DO NOT pass format: "xml" — XML is not supported. Only "json" or "html"; default to "html".
DO NOT poll or aggressively retry the SBOM endpoint if it times out — it is computationally expensive.
DO NOT hallucinate dependencies. Only report what is strictly inside the returned SBOM.