Skip to content
Get packs

SBOM Supply Chain Vulnerability Analyzer

Scans software bill of materials files for known vulnerabilities via the NVD CVE database

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent can read a software bill of materials (SBOM), which is an inventory of every software component in an application, in CycloneDX or SPDX JSON format. It looks up each component in the US NVD vulnerability database, maps dependency chains to show how risky libraries are pulled in indirectly, and produces a risk score and compliance-style report. It also suggests running syft to generate an SBOM and grype to cross-check results.

Great for

  • Security teams assessing vendor-supplied software SBOMs
  • Developers wanting a dependency vulnerability review in a CI/CD pipeline
  • Incident responders checking whether a newly disclosed CVE affects deployed software

Skip it if

  • Scanning live or running systems; the skill itself says to use Trivy, Grype CLI or host scanners instead
  • Anyone without an SBOM file or the tools to generate one, since the workflow depends on them
  • Authoritative compliance sign-off; scores are heuristic and the results need expert review

Try asking

  • “Check this CycloneDX SBOM for known CVEs and give me a risk summary by component”
  • “Build a dependency graph from our SPDX file and show which vulnerable libraries are transitive”
  • “Generate an SBOM for this Docker image with syft and correlate it with NVD”
  • “Summarise which components in this vendor SBOM are rated critical”
Step-by-step guide: how to use SBOM Supply Chain Vulnerability AnalyzerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-sbom-for-supply-chain-vulnerabilities.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-sbom-for-supply-chain-vulnerabilities.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-sbom-for-supply-chain-vulnerabilities.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Use an NVD API key; without one the script waits about 6 seconds between requests, making large SBOMs slow
  • Review the bundled script before running it, since it executes locally and calls external APIs
  • Treat the computed risk scores as a triage aid and verify critical findings against the NVD and vendor advisories

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.