testland/syft-generation
Generates, scans, and diffs Software Bills of Materials (SBOMs) with the Anchore stack - Syft generation from container images / directories / archives across OCI / Docker / Singularity formats (output CycloneDX-JSON / SPDX-JSON / Syft-JSON / table / GitHub-JSON, cosign attestation); the paired generate + scan workflow with Grype (`grype sbom:./sbom.json`, `--fail-on high`, `--only-fixed`, `.grype.yaml` ignore rules with mandatory `expires:`, EPSS/KEV prioritization); and SBOM-to-SBOM diffing via `cyclonedx diff --component-versions` to gate CI on net-new components and detect supply-chain drift between builds. Use when the team needs SBOM artifacts for compliance (US EO 14028, EU CRA, FDA medical-device guidance), SBOM-driven vulnerability scanning, or dependency-drift detection between releases.
77
97%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Medium
Suggest reviewing before use
formats.mdreferences/
Syft output formats and source types
Full catalogs extracted from syft-generation. Per
github.com/anchore/syft, Syft supports multiple SBOM output formats
and scan-source types; the SKILL.md spine keeps the common ones inline and
links here for the complete tables.
Output format catalog
| Format | Use |
|---|---|
cyclonedx-json | CycloneDX 1.5+ JSON; broad ecosystem support |
cyclonedx-xml | CycloneDX XML (older toolchains) |
spdx-json | SPDX 2.3 JSON; preferred by US Federal procurement |
spdx-tag-value | SPDX tag-value format (legacy) |
syft-json | Syft-native JSON; richest metadata |
table | Human-readable terminal table (default) |
github-json | GitHub dependency-graph submission format |
For Grype scan input (SKILL.md Step 7), use syft-json (richest metadata) or
cyclonedx-json (broader compat). For compliance delivery, the consumer's
requirement dictates: SPDX-JSON for US federal, CycloneDX-JSON for most EU
contexts.
Source types
| Source | Syntax |
|---|---|
| Local Docker daemon | syft alpine:latest |
| OCI / remote registry | syft registry:docker.io/alpine:latest |
| OCI archive (tar) | syft oci-archive:./image.tar |
| Docker archive (tar) | syft docker-archive:./image.tar |
| Local directory | syft dir:./my-project (or syft ./my-project) |
| File | syft file:./pom.xml |
| Singularity image | syft singularity:./image.sif |