analyzing-sbom-for-supply-chain-vulnerabilities

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is actionable and well-sequenced with strong executable examples, but it is somewhat verbose and does not leverage the provided bundle files through clear one-level-deep references, and it omits validation feedback loops for a batch API-driven workflow.

Suggestions

Trim the Key Concepts table and Tools & Systems prose to only terms/tools Claude would not already know, and shorten the illustrative compliance report to a compact template.

Add explicit validation checkpoints and a retry/rate-limit feedback loop around the NVD API calls and the overall scan, since this is a batch operation against a rate-limited service.

Link the existing bundle files from the body (e.g., 'See references/api-reference.md for full NVD endpoint details' and 'See scripts/agent.py for the complete implementation') so detail lives one level deep.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with executable examples, but the Key Concepts table explains terms Claude largely knows (SBOM, NVD, CPE) and the full compliance-report mock plus Tools & Systems descriptions add padding that could be trimmed.	2 / 3
Actionability	Provides copy-paste-ready bash (syft, grype) and executable Python (search_cves_by_cpe, build_dependency_graph) plus concrete JSON structures for both SBOM formats.	3 / 3
Workflow Clarity	Seven steps are clearly sequenced, but this batch operation (scanning many components against the rate-limited NVD API) lacks explicit validation checkpoints or validate->fix->retry feedback loops, capping the score at 2.	2 / 3
Progressive Disclosure	Bundle files exist (references/api-reference.md, scripts/agent.py) but the body never signals or links to them, leaving API details and the full implementation inline rather than split out for navigation.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and distinctive, clearly stating both capabilities and activation triggers in third person voice. It would naturally surface for the right supply-chain/SBOM requests.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions in third person voice: 'Parses Software Bill of Materials... Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports.'	3 / 3
Completeness	Explicitly answers both what (parses/correlates/builds/calculates/generates) and when via an explicit 'Activates for requests involving...' trigger clause.	3 / 3
Trigger Term Quality	Good coverage of natural trigger terms users would say: 'SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation'.	3 / 3
Distinctiveness Conflict Risk	Clear niche tied to specific formats (CycloneDX/SPDX) and the NVD CVE database with distinct triggers, making conflicts with other skills unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md
Commit: e612f49

Reviewed: about 10 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.