testland/syft-generation
Use when a team needs SBOMs for compliance (US EO 14028, EU CRA, FDA), SBOM-based vulnerability scanning or drift checks between releases. Generates CycloneDX or SPDX SBOMs with Syft from images or folders, scans them with Grype, diffs SBOMs in CI and explains how to choose a format.
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill contains instructions that run remote install scripts via curl from anchors.io during setup or execution, presenting an unverifiable external dependency.
Where we found it
syft (via get.anchore.io install script)
dependency · 1 site
The skill instructs users to install Syft by piping a remote install script from get.anchore.io directly to shell (curl | sh), an unverifiable external dependency.
SKILL.md
48
curl -sSfL https://get.anchore.io/syft | sh -s -- -b "$HOME/.local/bin"
grype (via get.anchore.io install script)
dependency · 1 site
The skill includes a commented but documented install command for Grype that pipes a remote install script from get.anchore.io directly to shell (curl | sh), an unverifiable external dependency.
SKILL.md
163
# curl -sSfL https://get.anchore.io/grype | sh -s -- -b "$HOME/.local/bin"
@cyclonedx/cyclonedx-bom
dependency · 1 site
The skill instructs users to run @cyclonedx/cyclonedx-bom via npx to validate CycloneDX SBOMs, an unverifiable external dependency fetched at runtime.
references/sbom-formats.md
164
npx @cyclonedx/cyclonedx-bom validate sbom.json
@cyclonedx/cyclonedx-npm
dependency · 3 sites
The skill instructs users to run @cyclonedx/cyclonedx-npm via npx to generate CycloneDX SBOMs for Node.js projects, an unverifiable external dependency fetched at runtime.
references/component-types-and-tooling.md
33
| Node.js | `@cyclonedx/cyclonedx-npm` | github.com/CycloneDX/cyclonedx-node-npm |
references/sbom-formats.md
194
- run: npx @cyclonedx/cyclonedx-npm --output-file=sbom.cyclonedx.json
212
`npx @cyclonedx/cyclonedx-npm --output-file=sbom.cyclonedx.json`.
spdx-tools
dependency · 2 sites
The skill instructs users to install spdx-tools via pip to validate SPDX SBOMs, an unverifiable external dependency fetched at runtime.
references/spdx.md
169
pip install spdx-tools
references/spdx.md
190
pip install spdx-tools
anchore/sbom-action@v0
dependency · 4 sites
The skill invokes the GitHub Action anchore/sbom-action@v0 via uses: in workflow YAML, an unverifiable external dependency fetched at runtime.
SKILL.md
Line 282
Line 287
references/sbom-formats.md
Line 196
references/spdx.md
Line 185
actions/checkout@v5
dependency · 3 sites
The skill invokes the GitHub Action actions/checkout@v5 via uses: in workflow YAML, an unverifiable external dependency fetched at runtime.
SKILL.md
Line 281
references/sbom-formats.md
Line 192
references/spdx.md
Line 184
actions/upload-artifact@v4
dependency · 2 sites
The skill invokes the GitHub Action actions/upload-artifact@v4 via uses: in workflow YAML, an unverifiable external dependency fetched at runtime.
SKILL.md
Line 292
references/spdx.md
Line 192
anchore/scan-action@v5
dependency · 1 site
The skill invokes the GitHub Action anchore/scan-action@v5 via uses: in workflow YAML, an unverifiable external dependency fetched at runtime.
SKILL.md:201
github/codeql-action/upload-sarif@v3
dependency · 1 site
The skill invokes the GitHub Action github/codeql-action/upload-sarif@v3 via uses: in workflow YAML, an unverifiable external dependency fetched at runtime.
SKILL.md:207
- Audited
- Security analysis