sbom

Generate and manage Software Bill of Materials (SBOMs) for the OpenShell project. Covers SBOM generation with Syft, license resolution via public registries, and CSV export for compliance review. Trigger keywords - SBOM, sbom, bill of materials, license audit, license resolution, generate sbom, sbom csv, dependency license, supply chain, license scan.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable skill body with concrete commands and clear workflow sequencing. The main gaps are a missing explicit validation checkpoint in the core pipeline and some inline detail that could be offloaded to reference files.

Suggestions

Add an explicit validation checkpoint in the main `mise run sbom` workflow — e.g., run `mise run sbom:check` after generation and review the unresolved-licenses report before exporting CSV.

Condense the 'Inspecting an Image SBOM' and 'Inspecting an Auditable Image Binary' sections or move them to a reference file, since they are niche and inflate the body for the common source-tree workflow.

Split the License Resolution Details and Output Files tables into a one-level-deep reference document linked from SKILL.md to improve progressive disclosure for this >50-line skill.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean — tables, copy-paste commands, and concise sections that assume competence — but the niche 'Inspecting an Image SBOM' and 'Inspecting an Auditable Image Binary' sections add detail that could be trimmed or moved out.	4 / 5
Actionability	Guidance is fully executable and copy-paste ready — `mise run sbom`, `docker buildx imagetools inspect ...`, `mise x -- syft ...`, and `uv run python deploy/sbom/resolve_licenses.py <file>` — and the Quick Reference table covers the common cases.	5 / 5
Workflow Clarity	The three-stage chain (Generate → Resolve → CSV) and individual stage commands are clearly sequenced, and `verify-image-sbom.sh` / `mise run sbom:check` provide verification, but the main pipeline lacks an explicit validation checkpoint after generation.	4 / 5
Progressive Disclosure	Content is well organized into clearly labeled sections with a Quick Reference table for navigation and no nested references, but everything is inline with no one-level-deep reference files, leaving minor organization gaps for a >50-line skill.	4 / 5
	Total	17 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-targeted description that names concrete actions and a specific tool, and supplies an explicit, comprehensive trigger-keyword list covering both what and when. The only minor weakness is the slightly generic 'manage' verb.

Dimension	Reasoning	Score
Specificity	Names several concrete actions with a specific tool — 'SBOM generation with Syft', 'license resolution via public registries', 'CSV export for compliance review' — but the leading 'Generate and manage' leaves 'manage' generic, a minor coverage gap versus the comprehensive anchor.	4 / 5
Completeness	It clearly states what the skill does (generate, resolve, export) and provides equivalent explicit trigger guidance via the concrete 'Trigger keywords' list, satisfying both the 'what' and 'when' with concrete trigger phrases.	5 / 5
Trigger Term Quality	The 'Trigger keywords' list gives comprehensive natural coverage with synonyms and phrasings users would actually say — 'SBOM', 'bill of materials', 'license audit', 'license resolution', 'generate sbom', 'sbom csv', 'supply chain', 'license scan'.	5 / 5
Distinctiveness Conflict Risk	The SBOM/license-audit niche scoped to the OpenShell project is clearly distinct, with specific triggers ('bill of materials', 'license audit', 'supply chain') that minimize overlap with unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: NVIDIA/OpenShell
Path: .agents/skills/sbom/SKILL.md
Commit: 69a05eb

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.