generating-and-analyzing-sboms

mukul975/Anthropic-Cybersecurity-SkillsSecurityAudit pendingSnapshot fc4dac81bc95

Summary

This source did not publish a separate summary. Review SKILL.md before using the skill.

SKILL.md

Generating and Analyzing SBOMs

Authorized Use Only: Generate and scan SBOMs only for software and images you own or are authorized to assess. Treat SBOMs as sensitive inventory data — they reveal your dependency attack surface.

Overview

A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of every component, library, and dependency in a piece of software — the supply-chain equivalent of an ingredients label. SBOMs are central to defending against supply-chain compromise (CISA's SBOM initiative, US Executive Order 14028) because you cannot patch what you cannot see. The two dominant SBOM standards are:

CycloneDX — an OWASP standard optimized for security use cases (vulnerabilities, VEX, dependency relationships).
SPDX — a Linux Foundation / ISO standard (ISO/IEC 5962) strong on licensing and provenance.

The reference open-source toolchain is from Anchore:

Syft generates SBOMs (CycloneDX, SPDX, or its native format) from container images and filesystems.
Grype matches an SBOM (or image) against vulnerability databases to find CVEs.
Cosign (Sigstore) signs SBOMs and attaches them to images as signed attestations for tamper-evident provenance.

This skill covers producing standards-compliant SBOMs, correlating them with vulnerability intelligence, and embedding the workflow into CI/CD.

When to Use

Establishing and maintaining a component inventory for applications and container images.
Continuously detecting known vulnerabilities (including newly disclosed CVEs against existing artifacts).
Satisfying procurement/regulatory SBOM requirements (CISA, EO 14028).
Producing signed SBOM attestations for downstream supply-chain trust.

Prerequisites

Install Syft and Grype (official install scripts):

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

ID	Official Technique Name	Relevance to this skill
T1195.001	Supply Chain Compromise: Compromise Software Dependencies and Development Tools	SBOM generation and vulnerability correlation expose compromised or vulnerable dependencies — the attack surface adversaries abuse under this technique.

syft alpine:latest -o cyclonedx-json=alpine.cdx.json

syft dir:. -o spdx-json=app.spdx.json

syft myorg/app:1.4.2 \
  -o cyclonedx-json=app.cdx.json \
  -o spdx-json=app.spdx.json \
  -o table

# Scan an existing SBOM
grype sbom:app.cdx.json -o table

# JSON report for automation
grype sbom:app.cdx.json -o json > app.vulns.json

grype myorg/app:1.4.2 -o table

grype sbom:app.cdx.json --fail-on high

grype sbom:app.cdx.json --only-fixed --fail-on critical

# Key-based signing
cosign attest --key cosign.key \
  --predicate app.spdx.json \
  --type spdxjson \
  myorg/app:1.4.2

# Keyless (Sigstore OIDC / Fulcio + Rekor)
COSIGN_EXPERIMENTAL=1 cosign attest \
  --predicate app.cdx.json \
  --type cyclonedx \
  myorg/app:1.4.2

cosign verify-attestation --key cosign.pub --type spdxjson myorg/app:1.4.2

cosign download attestation myorg/app:1.4.2 \
  | jq -r '.payload' | base64 -d | jq '.predicate' > pulled.spdx.json
grype sbom:pulled.spdx.json -o table

Tool	Purpose	Link
Syft	SBOM generation	https://github.com/anchore/syft
Grype	Vulnerability scanning of SBOMs/images	https://github.com/anchore/grype
Cosign	SBOM signing/attestation	https://github.com/sigstore/cosign
CycloneDX	Security-focused SBOM standard	https://cyclonedx.org/
SPDX	ISO SBOM standard	https://spdx.dev/
CISA SBOM	Guidance and minimum elements	https://www.cisa.gov/sbom

Aspect	CycloneDX	SPDX
Steward	OWASP	Linux Foundation / ISO 5962
Strength	Security, VEX, vulnerabilities	Licensing, provenance
Common syft `-o` values	`cyclonedx-json`, `cyclonedx-xml`	`spdx-json`, `spdx` (tag-value)

generating-and-analyzing-sboms

Summary

SKILL.md

Generating and Analyzing SBOMs

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Workflow

1. Generate a CycloneDX SBOM from a container image

2. Generate an SPDX SBOM from a source directory

3. Emit multiple formats at once

4. Scan the SBOM for vulnerabilities with Grype

5. Gate CI/CD on severity

6. Sign and attach the SBOM as an attestation

7. Verify the attestation downstream

8. Retrieve and re-scan attached SBOMs

9. Correlate to vulnerability intelligence

Tools and Resources

Format Comparison

Validation Criteria

Related skills