Skip to content
Get packs

Guide · Agent skill

How to use the SBOM Supply Chain Vulnerability Analyzer agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This agent skill teaches an AI agent to read a software bill of materials (SBOM) in CycloneDX or SPDX JSON format, look up each component in the US NVD vulnerability database, and produce a risk-scored report. It is aimed at security teams reviewing vendor software, developers checking dependencies, and incident responders checking a newly disclosed CVE. After this guide you will know how to install the skill, how to phrase requests that trigger it, and what it needs to run.

SBOM Supply Chain Vulnerability Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and extract it. Confirm the folder contains SKILL.md, scripts/agent.py and references/api-reference.md.
  2. 2Place the skill folder. Move the folder to ~/.claude/skills/ for personal use or to .claude/skills/ in a project. You can instead upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
  3. 3Install the Python libraries. Install requests, networkx and packaging on Python 3.9 or newer.
  4. 4Prepare an SBOM. Use an existing CycloneDX JSON or SPDX JSON file, or generate one with syft.
  5. 5Ask the agent in plain language. Name the SBOM file and the outcome you want, such as a CVE list or risk score.
  6. 6Cross-check with grype. Run grype against the same SBOM and compare its findings with the skill's report.
  7. 7Review the output. Treat the scores as heuristic and have an expert verify high-risk findings before acting.

What the skill makes the agent do

An SBOM is an inventory of every software component in an application. This skill tells the agent how to parse that inventory, extract each component's name, version, purl and CPE identifiers, and correlate them with CVEs from the NVD 2.0 API.

Beyond the lookup, the skill builds a dependency graph to show how risky libraries are pulled in indirectly, calculates component and overall risk scores, and generates a compliance-style report. It also suggests using syft to generate an SBOM and grype to cross-check the findings.

  • Parses CycloneDX JSON (v1.4+) and SPDX JSON (v2.3+) SBOM files
  • Queries the NVD by CPE name or keyword
  • Traces transitive dependency paths
  • Assigns CRITICAL, HIGH, MEDIUM or LOW risk levels
  • Produces a structured vulnerability analysis report

Install the skill from the ZIP or the Claude apps

Download the skill ZIP from this page and unzip it. For a personal install, place the folder in ~/.claude/skills/. For a single project, place it in the project's .claude/skills/ folder. Alternatively, in the Claude apps go to Settings → Capabilities → Skills and upload the ZIP there.

The skill folder should contain SKILL.md, scripts/agent.py and references/api-reference.md.

  • Personal: ~/.claude/skills/
  • Project: .claude/skills/ inside the project
  • Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Install the requirements

The skill needs Python 3.9 or newer with three libraries: requests, networkx and packaging. An NVD API key is optional; it is free and raises your rate limit. The skill also needs internet access to services.nvd.nist.gov. syft and grype are optional command-line tools used to generate and cross-check SBOMs.

  • Python 3.9+ with requests, networkx and packaging
  • Network access to services.nvd.nist.gov
  • Optional: NVD API key (free) for higher rate limits
  • Optional: syft and grype command-line tools
pip install requests networkx packaging

Trigger the skill with a natural request

You do not need a special command. Describe the task in plain language and mention an SBOM, CycloneDX, SPDX, CVE or dependency vulnerability check. The skill's description lists these terms, so requests using them are the ones most likely to activate it.

Give the agent the path to your SBOM file and say what you want back, such as a risk score, a list of CVEs or a report.

  • Check vendor-sbom.json for known CVEs and give me a risk score
  • Analyze this CycloneDX SBOM for transitive vulnerabilities through express
  • Correlate the components in sbom-spdx.json with the NVD and list critical findings
  • Generate a supply chain vulnerability report for this SPDX file

Generate an SBOM first if you do not have one

If you have no SBOM, the skill's workflow suggests syft. It can create a CycloneDX or SPDX JSON file from a container image or project directory. Syft covers more than 30 package ecosystems, including npm, PyPI, Maven, Go modules, apt, apk and RPM.

The examples below come from the skill's source. Replace the image name and paths with your own.

syft alpine:latest -o cyclonedx-json > sbom-cyclonedx.json syft dir:/path/to/project -o spdx-json > sbom-spdx.json

Cross-check the results with grype

The skill suggests grype to scan the same SBOM independently. Grype also draws on GitHub Security Advisories and several Linux distribution databases, so its coverage is broader than NVD alone. Compare its output with the skill's findings before acting on either.

  • Use --only-fixed to show only vulnerabilities with a fix available
  • Use --fail-on critical to make the command fail on critical findings, which suits CI pipelines
grype sbom:sbom-cyclonedx.json -o json > grype-results.json

Safety notes before you run it

This skill runs scripts and uses the network. It sends component identifiers to services.nvd.nist.gov, so do not run it against an SBOM you are not allowed to share with that service. Review scripts/agent.py before running it on sensitive material.

The skill is not for scanning live or running systems. For runtime scanning, the skill itself points to Trivy, Grype CLI or host scanners such as Nessus or Qualys.

  • Runs scripts: yes (scripts/agent.py)
  • Uses network: yes (NVD API)
  • Use an NVD API key to avoid rate-limit failures on large SBOMs

Tips for better results

Use a complete SBOM with CPE or purl identifiers, because the NVD lookup depends on them. Check the report's risk scores as heuristic values that need expert review, not as compliance sign-off. Treat the reported dependency counts and levels as a starting point for triage.

  • Include purl and CPE fields in the SBOM where possible
  • Get a free NVD API key before analyzing large files
  • Review high-risk findings manually and confirm with grype
  • Keep the NVD and grype data current before each assessment

What people use it for

  • Security teams reviewing SBOMs supplied by vendors before procurement
  • Developers running a dependency vulnerability review in a CI/CD pipeline
  • Incident responders checking whether a newly disclosed CVE affects software they deploy

Frequently asked questions

How do I install the SBOM analyzer agent skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder. In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.

What do I need to run it?

You need Python 3.9 or newer with requests, networkx and packaging, plus internet access to services.nvd.nist.gov. An SBOM file in CycloneDX JSON or SPDX JSON format is also required. syft and grype are optional.

Is the SBOM analyzer skill free?

The skill is licensed under Apache-2.0. An NVD API key is optional and free, and it raises your rate limit from 5 to 50 requests per 30 seconds.

What if I don't have an SBOM file?

The skill's workflow suggests generating one with syft from a container image or project directory. Without an SBOM file or tools to create one, the workflow cannot run.

Can it scan a running server?

No. The skill says not to use it for runtime scanning of live systems and recommends Trivy, Grype CLI or host scanners such as Nessus or Qualys.

How does it compare with grype?

The skill queries the NVD and builds dependency graphs and risk scores. Grype also draws on GitHub Security Advisories and Linux distribution databases, so the skill suggests running grype to cross-check results.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Choose this skill if you are a security team, developer or incident responder who already has CycloneDX or SPDX JSON SBOMs and wants an agent to correlate them with NVD CVEs and explain transitive risk. Pick another tool if you need to scan running systems, need authoritative compliance sign-off, or have no SBOM and no way to generate one.

Download the skill