菜单
Generate a Software Bill of Materials (SBOM) from your AWS environment and scan for vulnerable/compromised packages.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | sbom |
| description | Generate a Software Bill of Materials (SBOM) from your AWS environment and scan for vulnerable/compromised packages. |
| user-invocable | true |
Discover dependencies in your AWS environment, check for vulnerabilities and supply chain compromises.
Read shasta.config.json for python_cmd. Use that for all commands (shown as <PYTHON_CMD>).
Run SBOM discovery and vulnerability scan:
<PYTHON_CMD> -c "
import json
from shasta.config import get_aws_client
from shasta.sbom.discovery import discover_sbom, save_sbom
from shasta.sbom.vuln_scanner import scan_sbom_vulnerabilities, save_vuln_report
client = get_aws_client()
client.validate_credentials()
print('Discovering software dependencies...')
sbom = discover_sbom(client)
sbom_path = save_sbom(sbom)
print(f'SBOM: {sbom.total_dependencies} dependencies across {list(sbom.ecosystems.keys())}')
print(f'Supply chain alerts: {len(sbom.supply_chain_alerts)}')
if sbom.total_dependencies > 0:
print('Scanning for vulnerabilities...')
vulns = scan_sbom_vulnerabilities(sbom)
vuln_path = save_vuln_report(vulns)
print(f'Vulnerabilities: {vulns.total_vulnerabilities} ({vulns.critical} critical, {vulns.high} high)')
print(f'CISA KEV matches: {vulns.kev_count}')
"
Present results: dependency inventory, supply chain alerts, vulnerability counts. CISA KEV matches are ACTIVELY EXPLOITED — treat as P1.
Deep code scan for AI security issues — prompt injection, PII in prompts, hardcoded keys, unguarded agents.
Run AI governance checks across cloud accounts and code repos — ISO 42001, EU AI Act, NIST AI RMF compliance.
Scan cloud accounts and GitHub repos to discover AI/ML services and build an AI system inventory.
Walk staged changes against the engineering principles checklist and report pass/fail per principle. Run before any non-trivial commit. Catches doc drift, stub functions, single-region defaults, missing framework mappings, and other regressions before they ship.
Generate a public-facing security trust page from scan data. Produces a single deployable index.html that shows compliance framework scores, security policies, infrastructure overview, and data protection posture. Deployable to S3, Vercel, Netlify, or GitHub Pages.
Paste a vendor's domain. Get a security risk assessment in 60 seconds.