Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

ns-generate-sbom

Estrellas3

Forks0

Actualizado30 de junio de 2026 a las 12:18

Generates a Software Bill of Materials (SBOM) for a connected or registered N|Solid Node.js app. Use when the user asks for SBOM, software bill of materials, compliance evidence, SOC2/vendor review, license inventory, dependency inventory, or transitive package report for a running application.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

nodesource

nodesource/nsolid-plugin

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Desarrolladores de softwareOcupaciones informáticas y matemáticas·SOC 15-1252

SKILL.md

readonly

name	ns-generate-sbom
description	Generates a Software Bill of Materials (SBOM) for a connected or registered N\|Solid Node.js app. Use when the user asks for SBOM, software bill of materials, compliance evidence, SOC2/vendor review, license inventory, dependency inventory, or transitive package report for a running application.

Instructions

1. Identify Target Application

Determine the specific app name you need the SBOM for.
If the app name is unknown, call information-dashboard (no parameters) to list all connected agents and their app names.
Do NOT use global-filter — it returns ~18,000 tokens and is wasteful for a simple app name lookup.

2. Determine Format Requirement

The sbom tool's format parameter accepts only "json" or "html". It does not support XML.
If the user does not specify a format, default to "html" (human-readable compliance report).
Use "json" only when the user explicitly wants programmatic/machine analysis (e.g. feeding it to another tool).

3. Generate SBOM

Call the sbom tool with the app parameter and format set to "html" (default) or "json".

4. Handle Execution Edge Cases

Timeout warning: Generating an SBOM traverses the entire transitive dependency tree of a live process. The N|Solid server extends the timeout to 180 seconds.
If your MCP client drops the connection at 60s, inform the user the server is still processing, or suggest adjusting their MCP client timeout. Do not retry immediately.

5. Provide Output

If the user asked to download the SBOM, write it directly to the .nsolid/sbom/ folder (create the folder if it does not exist):
- HTML: .nsolid/sbom/<appName>_sbom.html
- JSON: .nsolid/sbom/<appName>_sbom.json
Do not stage the output in a temporary file or /tmp — write straight to .nsolid/sbom/.
Give the user a high-level summary (total packages, top licenses, notable dependencies) and the saved path.

Guardrails

DO NOT pass format: "xml" — XML is not supported. Only "json" or "html"; default to "html".
DO NOT poll or aggressively retry the SBOM endpoint if it times out — it is computationally expensive.
DO NOT hallucinate dependencies. Only report what is strictly inside the returned SBOM.

Más de este repositorio

mismo repositorio

ns-advanced-memory-leak-hunter

nodesource/nsolid-plugin

Performs an advanced N|Solid memory leak hunt comparing baseline vs peak heap evidence to isolate retained constructors, closures, and retainer paths. Use when the user reports recurring/staircase memory growth, elusive leaks, retained objects, closures holding references, or a standard heap sample/snapshot analysis was inconclusive. Prefer supplied baseline/peak assets; capture new samples only when needed.

2026-06-303

ns-analyze-asset

nodesource/nsolid-plugin

Analyzes an existing N|Solid diagnostic asset by asset ID or local asset path using asset-summary. Use when the user asks to inspect, review, summarize, or interpret an already-captured CPU profile, heap profile, heap sample, or heap snapshot, including assets just produced by ns-generate-asset. Do not use to capture new profiles/snapshots.

2026-06-303

ns-cpu-spike-analysis

nodesource/nsolid-plugin

Diagnoses high CPU or slow execution in a Node.js app using supplied evidence or N|Solid CPU metrics/profiles. Use when the user reports CPU spike, high CPU percent, slow endpoint/function, event loop blocking, flamegraph/profile analysis, hot loop, or asks why an app is slow. Prefer existing asset IDs, summaries, trace data, or local profiles before capturing a new profile.

2026-06-303

ns-generate-asset

nodesource/nsolid-plugin

Captures a new N|Solid diagnostic asset for a connected Node.js app. Use when the user explicitly asks to collect, capture, or generate a CPU profile, flamegraph, heap sample, heap snapshot, or heap tracking asset and wants it saved or handed off for analysis. For existing assets, use ns-analyze-asset instead.

2026-06-303

ns-memory-spike-analysis

nodesource/nsolid-plugin

Diagnoses memory growth, heap spikes, RSS increases, OOMs, and suspected leaks in Node.js apps using supplied heap evidence or N|Solid heap sampling/snapshots. Use when the user reports memory leak, heap growing, high RSS, out-of-memory, heap snapshot/profile analysis, or wants memory root-cause triage.

2026-06-303

ns-analyze-tracing

nodesource/nsolid-plugin

Analyzes N|Solid/OpenTelemetry tracing evidence for request latency, HTTP errors, and service dependencies. Use when the user asks about slow endpoints, API timeouts, distributed traces/spans, N+1 queries, await chains, microservice latency, cascading failures, or trace IDs. Query N|Solid only when no trace data was provided. Do not assume full waterfall details unless supplied.

2026-06-303

name	ns-generate-sbom
description	Generates a Software Bill of Materials (SBOM) for a connected or registered N\|Solid Node.js app. Use when the user asks for SBOM, software bill of materials, compliance evidence, SOC2/vendor review, license inventory, dependency inventory, or transitive package report for a running application.

Instructions

1. Identify Target Application

Determine the specific app name you need the SBOM for.
If the app name is unknown, call information-dashboard (no parameters) to list all connected agents and their app names.
Do NOT use global-filter — it returns ~18,000 tokens and is wasteful for a simple app name lookup.

2. Determine Format Requirement

The sbom tool's format parameter accepts only "json" or "html". It does not support XML.
If the user does not specify a format, default to "html" (human-readable compliance report).
Use "json" only when the user explicitly wants programmatic/machine analysis (e.g. feeding it to another tool).

3. Generate SBOM

Call the sbom tool with the app parameter and format set to "html" (default) or "json".

4. Handle Execution Edge Cases

Timeout warning: Generating an SBOM traverses the entire transitive dependency tree of a live process. The N|Solid server extends the timeout to 180 seconds.
If your MCP client drops the connection at 60s, inform the user the server is still processing, or suggest adjusting their MCP client timeout. Do not retry immediately.

5. Provide Output

If the user asked to download the SBOM, write it directly to the .nsolid/sbom/ folder (create the folder if it does not exist):
- HTML: .nsolid/sbom/<appName>_sbom.html
- JSON: .nsolid/sbom/<appName>_sbom.json
Do not stage the output in a temporary file or /tmp — write straight to .nsolid/sbom/.
Give the user a high-level summary (total packages, top licenses, notable dependencies) and the saved path.

Guardrails

DO NOT pass format: "xml" — XML is not supported. Only "json" or "html"; default to "html".
DO NOT poll or aggressively retry the SBOM endpoint if it times out — it is computationally expensive.
DO NOT hallucinate dependencies. Only report what is strictly inside the returned SBOM.