CtrlK
BlogDocsLog inGet started
Tessl Logo

sbom-analyzer

Software Bill of Materials (SBOM) security analysis for vulnerability assessment and third-party risk management. Validates SBOMs from vendors or generates SBOMs for internal projects. Use this skill when: - User asks to analyze an SBOM file - User mentions "third-party risk" or "vendor security" - User needs to validate a supplier's SBOM - User wants to check SBOM for vulnerabilities - User asks about CycloneDX or SPDX formats

68

Quality

81%

Does it follow best practices?

Impact

No eval scenarios have been run

SecuritybySnyk

Passed

No known issues

SKILL.md
Quality
Evals
Security

Quality

Content

62%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a well-structured SBOM analysis skill with a clear four-phase workflow and good error handling coverage. Its main weaknesses are verbosity in report templates (which Claude could generate from briefer specifications) and the lack of truly executable validation logic — much of the guidance is template-based rather than actionable code. The workflow sequencing with validation checkpoints is a notable strength.

Suggestions

Condense report templates to brief structural outlines (e.g., 'Generate a table with columns: Component, Version, CVE, CVSS, Exploited') rather than full example reports — Claude can produce well-formatted reports from minimal specifications.

Move the vendor communication template and detailed remediation table formats to a separate reference file (e.g., TEMPLATES.md) to reduce the main skill's token footprint.

Add executable validation logic (e.g., a jq command or Python snippet to check for missing purls) rather than relying on manual JSON inspection instructions in Phase 1.

DimensionReasoningScore

Conciseness

The skill is reasonably efficient but includes some unnecessary verbosity. The example report templates are lengthy and could be more concise — Claude can generate report formats without such detailed templates. The vendor communication template and some of the table structures add bulk that Claude could infer. However, the format tables and error handling sections are appropriately sized.

2 / 3

Actionability

The skill provides concrete tool calls (mcp_snyk_snyk_sbom_scan) and CLI commands (snyk sbom), which is good. However, much of the content is report templates and output formatting rather than executable guidance. The validation steps (Phase 1) are manual inspection instructions rather than executable code, and the risk analysis phase is essentially a report template with placeholder data rather than concrete logic for how to compute risk scores or process scan results.

2 / 3

Workflow Clarity

The four-phase workflow (Validate → Scan → Analyze → Remediate) is clearly sequenced with explicit validation in Phase 1 before scanning in Phase 2. The validation step includes a clear checkpoint — if the SBOM is incomplete, report issues and request an updated SBOM before proceeding. The error handling section provides feedback loops for common failure modes. The workflow is well-structured for a multi-step process involving external tool calls.

3 / 3

Progressive Disclosure

The content is well-organized with clear sections and phases, but it's a monolithic document at ~200+ lines that could benefit from splitting detailed report templates and the vendor communication template into separate reference files. No bundle files exist, and no references to external files are made, so all content is inline. The structure is good but the volume of template content inline reduces the score.

2 / 3

Total

9

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a strong skill description that clearly defines its domain (SBOM security analysis), lists concrete capabilities (validation, generation, vulnerability assessment), and provides explicit trigger guidance with five well-chosen scenarios. The description uses proper third-person voice and includes both technical format names (CycloneDX, SPDX) and natural language terms (vendor security, third-party risk) that users would actually say.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions: 'security analysis for vulnerability assessment', 'third-party risk management', 'validates SBOMs from vendors', 'generates SBOMs for internal projects'. These are specific, actionable capabilities.

3 / 3

Completeness

Clearly answers both 'what' (SBOM security analysis, vulnerability assessment, validation, generation) and 'when' with an explicit 'Use this skill when:' clause listing five specific trigger scenarios.

3 / 3

Trigger Term Quality

Excellent coverage of natural trigger terms users would say: 'SBOM', 'third-party risk', 'vendor security', 'supplier's SBOM', 'vulnerabilities', 'CycloneDX', 'SPDX'. These cover both common language and specific format names users would mention.

3 / 3

Distinctiveness Conflict Risk

SBOM analysis is a clear niche with distinct triggers like 'CycloneDX', 'SPDX', 'SBOM', and 'supplier's SBOM'. This is unlikely to conflict with general security or vulnerability scanning skills due to the specific SBOM focus.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository
snyk/studio-recipes
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.