testland/syft-generation
Use for any question or task about SBOMs, including generating one for a container image or folder, adding SBOM generation and vulnerability scanning to a release job, compliance (US EO 14028, EU CRA, FDA) or drift between releases. Generates CycloneDX or SPDX SBOMs with Syft, scans them with Grype, diffs SBOMs in CI and explains how to choose a format.
88%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Passed
No findings from the security scan
formats.mdreferences/
Syft output formats and source types
Full catalogs extracted from syft-generation. Per
github.com/anchore/syft, Syft supports multiple SBOM output formats
and scan-source types; the SKILL.md spine keeps the common ones inline and
links here for the complete tables.
Output format catalog
| Format | Use |
|---|---|
cyclonedx-json | CycloneDX 1.5+ JSON; broad ecosystem support |
cyclonedx-xml | CycloneDX XML (older toolchains) |
spdx-json | SPDX 2.3 JSON; preferred by US Federal procurement |
spdx-tag-value | SPDX tag-value format (legacy) |
syft-json | Syft-native JSON; richest metadata |
table | Human-readable terminal table (default) |
github-json | GitHub dependency-graph submission format |
For Grype scan input (SKILL.md Step 7), use syft-json (richest metadata) or
cyclonedx-json (broader compat). For compliance delivery, the consumer's
requirement dictates: SPDX-JSON for US federal, CycloneDX-JSON for most EU
contexts.
Source types
| Source | Syntax |
|---|---|
| Local Docker daemon | syft alpine:latest |
| OCI / remote registry | syft registry:docker.io/alpine:latest |
| OCI archive (tar) | syft oci-archive:./image.tar |
| Docker archive (tar) | syft docker-archive:./image.tar |
| Local directory | syft dir:./my-project (or syft ./my-project) |
| File | syft file:./pom.xml |
| Singularity image | syft singularity:./image.sif |