sbom

Generate and manage Software Bill of Materials (SBOMs) for the OpenShell project. Covers SBOM generation with Syft, license resolution via public registries, and CSV export for compliance review. Trigger keywords - SBOM, sbom, bill of materials, license audit, license resolution, generate sbom, sbom csv, dependency license, supply chain, license scan.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, highly actionable single-file skill with concrete commands and clear stage sequencing. Its main weaknesses are command duplication across sections, a missing inline verification checkpoint in the main batch workflow, and reference detail kept inline rather than progressively disclosed.

Suggestions

Eliminate duplicated commands: either drop the Quick Reference table or remove the inline `mise run sbom:*` examples from Workflow 2, citing each command exactly once.

Add an explicit verification checkpoint to the main `mise run sbom` workflow (e.g., run `mise run sbom:check` afterward and act on unresolved licenses) rather than presenting it only as a separate CI advisory.

Move the License Resolution Details registry table and the Output Files / Key Files tables into a separate reference file so SKILL.md stays a lean overview with a signaled one-level-deep pointer.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and free of concept over-explanation, but it could be tightened: the four `mise run sbom:*` commands each appear twice (Workflow 2 block and the Quick Reference table) and output file patterns are described in both Workflow 1 and the Output Files table.	2 / 3
Actionability	Provides fully executable, copy-paste-ready commands with real paths and task names (`mise run sbom`, `uv run python deploy/sbom/resolve_licenses.py /path/to/external-sbom.json`), matching the score-3 anchor.	3 / 3
Workflow Clarity	The three-stage Generate→Resolve→CSV sequence is clearly listed, but the main `mise run sbom` workflow has no inline validation checkpoint; verification (`sbom:check`) exists only as a separate CI advisory, so a batch license-resolution flow lacks an explicit feedback loop, capping this at 2.	2 / 3
Progressive Disclosure	A single self-contained file with good section/table organization, but it mixes overview and reference detail (registry, output, and key-file tables) inline rather than splitting reference material into a signaled separate file; no bundle references are present.	2 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific, third-person description that clearly states capabilities, gives explicit trigger guidance, and occupies a distinct niche. The only minor stylistic note is that triggers are listed as a comma-separated keyword block rather than woven into natural 'Use when...' prose.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'SBOM generation with Syft, license resolution via public registries, and CSV export for compliance review' — and uses third-person voice, matching the score-3 anchor of multiple specific concrete actions.	3 / 3
Completeness	Answers both what (generate/manage SBOMs, resolve licenses, CSV export) and when via the explicit 'Trigger keywords - ...' list, which is equivalent explicit trigger guidance and avoids the missing-'Use when' cap.	3 / 3
Trigger Term Quality	Explicitly enumerates natural user-facing terms ('bill of materials, license audit, license resolution, generate sbom, dependency license, supply chain, license scan'), giving good coverage of phrases a user would naturally say.	3 / 3
Distinctiveness Conflict Risk	The SBOM/Syft/license-audit niche is narrow and its triggers (bill of materials, license scan, supply chain) are distinctive, making conflict with other skills unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: NVIDIA/OpenShell
Path: .agents/skills/sbom/SKILL.md
Commit: deced87

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.