# SBOM Generator and CVE Matcher

> Generates Software Bill of Materials using Syft for container images and matches components against the NVD CVE database via OSV.dev API. Outputs CycloneDX and SPDX formats for supply chain compliance.

- Skill: `agentskillexchange/sbom-generator-and-cve-matcher` (Agent Skill)
- Install (CLI): `npx skillmds@latest add agentskillexchange/sbom-generator-and-cve-matcher`
- Raw SKILL.md: https://api.skillmd.com/api/skills/agentskillexchange/sbom-generator-and-cve-matcher/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: agentskillexchange (https://skillmd.com/u/agentskillexchange)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/agentskillexchange/sbom-generator-and-cve-matcher

---


# SBOM Generator and CVE Matcher

Generates Software Bill of Materials using Syft for container images and matches components against the NVD CVE database via OSV.dev API. Outputs CycloneDX and SPDX formats for supply chain compliance.

## Installation

Requirements and caveats from upstream:
- Supports dozens of packaging ecosystems (e.g. Alpine (apk), Debian (dpkg), RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, .NET, and [many more](https://oss.anchore.com/docs/capabilities/all-packages/))
- Supports OCI, Docker, [Singularity](https://github.com/sylabs/singularity), and [more image formats](https://oss.anchore.com/docs/guides/sbom/scan-targets/)
- **See [Installation docs](https://oss.anchore.com/docs/installation/syft/) for more ways to get Syft, including Homebrew, Docker, Scoop, Chocolatey, Nix, and more!**

Basic usage or getting-started notes:
- **New to Syft? Check out the [Getting Started guide](https://oss.anchore.com/docs/guides/sbom/getting-started/) for a walkthrough!**
- The quickest way to get up and going:
- bash

- Source: https://github.com/anchore/syft
- Extracted from upstream docs: https://raw.githubusercontent.com/anchore/syft/HEAD/README.md

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/sbom-generator-cve-matcher/)