| name | compliance-report |
| description | Build a compliance bundle — CycloneDX SBOM, SPDX license report, SARIF findings, OpenVEX/CycloneDX VEX, optional cosign signatures, manifest.json with SHA-256 sums, Markdown index. Use when assembling an audit bundle, SOC 2 attestation, supply-chain compliance package, or evidence for a customer security questionnaire. |
| argument-hint | [--sign] [--output-dir .vulnetix/compliance/] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["compliance","audit report","attestation","sbom bundle"] |
| chain | ["sbom-generate","vex-publish"] |
| outputBudget | medium |
| cooldown | per-session |
Vulnetix Compliance Report Skill
Use when
- Assembling an audit bundle for SOC 2, ISO 27001, or FedRAMP.
- Supply-chain compliance: producing CycloneDX SBOM + VEX + SARIF in one delivery.
- Evidence for a customer security questionnaire that asks for SBOM + signed attestations.
- Pre-release: assembling the security artefacts that ship alongside the release.
- Quarterly compliance review: regenerating the full bundle for archive.
Don't use for
- Just generating an SBOM — use
/vulnetix:sbom-generate.
- Per-CVE VEX statements — use
/vulnetix:vex-publish (this skill composes it).
- Single-scanner output — use the individual
/vulnetix:sast-scan, /vulnetix:secret-scan, etc.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Produces a bundle suitable for audit / attestation submission.
Step 1: Load capabilities
Read .vulnetix/capabilities.yaml. Use binaries.cosign to gate the --sign step.
Step 2: Generate artifacts in parallel
OUT="${OUTPUT_DIR:-.vulnetix/compliance/$(date -u +%Y%m%dT%H%M%SZ)}"
mkdir -p "$OUT"
vulnetix scan -o json-cyclonedx > "$OUT/sbom.cdx.json" &
vulnetix license -o json-spdx > "$OUT/licenses.spdx.json" &
vulnetix scan --evaluate-sast -o json-sarif > "$OUT/findings.sarif" &
wait
Step 3: Generate VEX (uses local memory.yaml)
