sbom-attestation
Generate, score, diff, sign and verify software bills of materials and build attestations. Produces CycloneDX and SPDX SBOMs with syft, checks them against the NTIA minimum elements, scans them with grype or trivy, signs images and attestations with Cosign (key or keyless with Fulcio and Rekor), verifies SLSA v1.0 provenance and GitHub artifact attestations by digest, and drafts admission policies (Sigstore policy-controller, Kyverno verifyImages) and VEX statements.
When to use
Use when the user asks to "generate an SBOM", "sign this image with cosign", "verify the provenance", "check SBOM quality", "compare two SBOMs", "set up keyless signing", or must prove supply-chain integrity for an audit (NTIA, CISA, EU CRA, SLSA). In French "generer un SBOM", "signer l'image avec cosign", "verifier la provenance", "attester le build".
Inputs and tools
The skill takes the request of the user in natural language: its frontmatter declares no argument. It declares no allowed-tools: the tools available are those of the agent that loads it, under the tool policy of the project.
Reference
| Field | Value |
|---|---|
| Name | sbom-attestation |
| Category | Security |
| Version | Not declared |
| Licence | Not declared |
| Allowed tools | Not declared |
| Plugins | - |
| Source | catalog/navin/skills/sbom-attestation/SKILL.md |
| Digest | sha256:643713ad40b47e3de4f6607767b3bc2250b2f068de4fb963108b979110fb19a2 |
skill_md_digest | sha256:503f0e525502fa97fb2992433196c257dac6cc28a131bec211c4b2652fe5cd71 |
| Emoji | 📦 |
Bundled files
| Path | Count |
|---|---|
catalog/navin/skills/sbom-attestation/examples | 2 |
catalog/navin/skills/sbom-attestation/references | 3 |
catalog/navin/skills/sbom-attestation/scripts | 2 |
Frontmatter
Every field of the SKILL.md frontmatter, with the value of the source:
| Field | Value |
|---|---|
name | sbom-attestation |
description | Generate, score, diff, sign and verify software bills of materials and build attestations. Produces CycloneDX and SPDX SBOMs with syft, checks them against the NTIA minimum elements, scans them with grype or trivy, signs images and attestations with Cosign (key or keyless with Fulcio and Rekor), verifies SLSA v1.0 provenance and GitHub artifact attestations by digest, and drafts admission policies (Sigstore policy-controller, Kyverno verifyImages) and VEX statements. Use when the user asks to "generate an SBOM", "sign this image with cosign", "verify the provenance", "check SBOM quality", "compare two SBOMs", "set up keyless signing", or must prove supply-chain integrity for an audit (NTIA, CISA, EU CRA, SLSA). In French "generer un SBOM", "signer l'image avec cosign", "verifier la provenance", "attester le build". |
metadata.navin.emoji | 📦 |
metadata.navin.category | security |