# Endor Sbom

> Manage Software Bill of Materials — export, import, analyze, and compare SBOMs in CycloneDX and SPDX formats. Use when the user says "generate SBOM", "export SBOM", "software bill of materials", "endor sbom", "compare SBOMs", "NTIA compliance", or needs component inventory for compliance. Do NOT use for vulnerability scanning (/endor-scan) or license analysis (/endor-license).

- Skill: `endorlabs/endor-sbom` (Agent Skill)
- Install (CLI): `npx skillmds@latest add endorlabs/endor-sbom`
- Raw SKILL.md: https://api.skillmd.com/api/skills/endorlabs/endor-sbom/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: endorlabs (https://skillmd.com/u/endorlabs)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/endorlabs/endor-sbom

---


# Endor Labs SBOM Management

Manage Software Bill of Materials - export, import, analyze, and compare.

## Supported Actions

| Action | Description |
|--------|-------------|
| `export` | Generate SBOM from current project |
| `import` | Import and analyze an external SBOM |
| `analyze` | Analyze project's component inventory |
| `compare` | Compare two SBOMs for drift detection |
| `validate` | Check SBOM format compliance |

## Workflow

### Action: Export

1. Use `get_resource` MCP tool (`resource_type`: `Project`, `name`: project/repo name) to get UUID. If not found, suggest `/endor-scan` first.
2. Export SBOM:
```bash
# CycloneDX (recommended)
npx -y endorctl sbom export --project-uuid {uuid} --format cyclonedx --output sbom-cyclonedx.json

# SPDX
npx -y endorctl sbom export --project-uuid {uuid} --format spdx --output sbom-spdx.json
```
3. Present summary with: format, file path, project name, component counts by type (Libraries/Frameworks/Applications/Total), top-level dependencies with versions and licenses, NTIA compliance checks (component names, versions, unique IDs, dependency relationships, author info, timestamp).

### Action: Analyze

1. Run `/endor-scan` if not already scanned
2. Query findings and dependencies
3. Present component breakdown:
   - Counts by category (direct/transitive/dev) with vuln and license risk counts
   - Vulnerability coverage: components with CVEs, critical/high count, reachable count
   - License distribution with risk levels

### Action: Compare

Compare two SBOMs for drift detection. Present:
- Added/removed/updated packages with versions
- Security impact: new vulns introduced, vulns resolved, net change
- License impact: new risks, resolved risks

### Action: Validate

Validate SBOM file against compliance standards. Check: format validity, NTIA minimum elements, component completeness, dependency relationships.

## Next Steps

1. `/endor-scan` - scan for vulnerabilities
2. `/endor-license` - check license compliance
3. `/endor-cicd` - automate SBOM generation

For data source policy, read references/data-sources.md.

## Error Handling

| Error | Action |
|-------|--------|
| Project not found | Run `/endor-scan` first |
| Auth error | Run `/endor-setup` |
| Invalid SBOM format | Show validation errors, suggest corrections |