CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/syft-generation

Generates, scans, and diffs Software Bills of Materials (SBOMs) with the Anchore stack - Syft generation from container images / directories / archives across OCI / Docker / Singularity formats (output CycloneDX-JSON / SPDX-JSON / Syft-JSON / table / GitHub-JSON, cosign attestation); the paired generate + scan workflow with Grype (`grype sbom:./sbom.json`, `--fail-on high`, `--only-fixed`, `.grype.yaml` ignore rules with mandatory `expires:`, EPSS/KEV prioritization); and SBOM-to-SBOM diffing via `cyclonedx diff --component-versions` to gate CI on net-new components and detect supply-chain drift between builds. Use when the team needs SBOM artifacts for compliance (US EO 14028, EU CRA, FDA medical-device guidance), SBOM-driven vulnerability scanning, or dependency-drift detection between releases.

77

Quality

97%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

Overview
Quality
Evals
Security
Files

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-quality, actionable skill body: executable commands and CI configs throughout, a sequenced multi-step workflow with validation and feedback loops for destructive/batch operations, and clean progressive disclosure to three real reference files. The only mild weakness is minor verbosity in repeated 'Per [sf-gh]' lead-ins and the compliance preamble.

Suggestions

Trim the recurring 'Per [sf-gh][sf-gh]' lead-ins and the Overview compliance paragraph — Claude can infer regulatory context from the 'When to use' list, saving tokens without losing clarity.

Consolidate the two install snippets (Syft Step 1 and Grype Step 7) into a single shared install note to reduce repetition across steps.

DimensionReasoningScore

Conciseness

The body is largely lean and assumes Claude's competence — concrete commands, compact tables, minimal concept re-explanation — but recurring 'Per [sf-gh][sf-gh]' lead-ins and the compliance preamble in the Overview add mild padding that could be trimmed. It sits noticeably above the 'mostly efficient' 3 anchor but short of the perfectly lean 5.

4 / 5

Actionability

Provides fully executable, copy-paste-ready bash and YAML across install, scan, attestation, Grype CI gating, and diffing, with specific flags covering the common cases (e.g., 'grype sbom:./sbom.json --fail-on high --only-fixed', 'cyclonedx diff ... --component-versions').

5 / 5

Workflow Clarity

A clearly sequenced 10-step workflow with explicit validation checkpoints and error-recovery feedback loops for the risky batch/CI operations: Step 6 inventory-accuracy validation, Step 7 mandatory ignore-rule triage + DB pinning, and Step 8's net-new-component CI gate with review-then-exit behavior.

5 / 5

Progressive Disclosure

The SKILL.md is a well-organized overview spine with clearly signaled one-level-deep references to real bundle files (references/formats.md, references/grype-ignore-rules.md, references/diff-ci-workflows.md), keeping detailed catalogs and full CI workflows out of the body while inlining the essential spine.

5 / 5

Total

19

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exceptionally strong description: comprehensive concrete capabilities, explicit 'Use when' trigger guidance, third-person voice, and natural user terminology including regulatory synonyms. It cleanly satisfies every dimension at the top anchor.

DimensionReasoningScore

Specificity

Lists multiple concrete actions across the SBOM lifecycle — 'Syft generation from container images / directories / archives', 'paired generate + scan workflow with Grype', 'cosign attestation', and 'SBOM-to-SBOM diffing via cyclonedx diff --component-versions' — giving comprehensive coverage rather than one or two actions.

5 / 5

Completeness

Explicitly answers both: what ('Generates, scans, and diffs Software Bills of Materials...') and when ('Use when the team needs SBOM artifacts for compliance..., SBOM-driven vulnerability scanning, or dependency-drift detection between releases'), with concrete trigger phrases.

5 / 5

Trigger Term Quality

Includes natural user-facing terms and their synonyms: 'SBOM', 'Software Bills of Materials', 'vulnerability scanning', 'compliance', 'dependency-drift', 'supply-chain drift', plus regulatory triggers (US EO 14028, EU CRA, FDA) — comprehensive coverage of phrases users would actually say.

5 / 5

Distinctiveness Conflict Risk

Occupies a clear niche — the Anchore SBOM stack (Syft/Grype/cyclonedx-cli) with distinct, specialized triggers unlikely to overlap with unrelated skills; minimal conflict risk.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents