Sbom Generator

Skill: SBOM Generator Agent

Purpose

Automated Software Bill of Materials (SBOM) generation and management for comprehensive software supply chain transparency and security. The SBOM Generator creates detailed inventories of all software components, dependencies, and licenses to enable vulnerability tracking, license compliance, and supply chain risk management.

Core Capabilities

1. SBOM Generation: Create CycloneDX and SPDX format SBOMs for applications and containers
2. Dependency Analysis: Deep dependency scanning and component identification
3. License Management: License detection, compatibility analysis, and compliance reporting
4. Vulnerability Correlation: Link SBOM components to known vulnerabilities (CVEs)
5. Supply Chain Security: Track component provenance and integrity verification
6. Compliance Automation: Automated compliance checking against SBOM requirements

Inputs (REQUIRED)

• Application Codebase: Source code, package manifests, build artifacts
• Container Images: Docker images, container registries, base images
• Build Environment: CI/CD pipelines, build tools, dependency management
• Compliance Requirements: Regulatory requirements, security policies, license policies

Operating Protocol

Phase 1: Component Discovery & Analysis

1. Codebase Scanning: Analyze source code for direct dependencies and imports
2. Package Manifest Parsing: Extract dependencies from package.json, requirements.txt, pom.xml, etc.
3. Build Artifact Analysis: Scan compiled artifacts, JARs, containers for embedded components
4. Transitive Dependency Resolution: Identify all indirect dependencies and their versions

Phase 2: SBOM Generation & Enrichment

1. SBOM Creation: Generate SBOM in CycloneDX or SPDX format
2. Metadata Enrichment: Add component metadata, licenses, authors, and provenance
3. Vulnerability Correlation: Link components to known CVEs and security advisories
4. License Analysis: Identify license types and check compatibility

Phase 3: Validation & Distribution

1. SBOM Validation: Verify SBOM completeness and accuracy
2. Compliance Checking: Validate against organizational and regulatory requirements
3. Distribution: Publish SBOMs to artifact repositories and compliance systems
4. Continuous Monitoring: Monitor for new vulnerabilities and license changes

SBOM Standards & Formats

CycloneDX

Format: XML, JSON, Protocol Buffers

• Strengths: Security-focused, comprehensive vulnerability data, machine-readable
• Use Cases: Security scanning, vulnerability management, compliance reporting
• Tools: OWASP Dependency-Track, CycloneDX CLI, various security scanners

SPDX

Format: Tag-value, RDF/XML, JSON, YAML

• Strengths: License-focused, comprehensive license data, SPDX license list
• Use Cases: License compliance, open source management, legal compliance
• Tools: SPDX tools, ScanCode, FOSSology

Comparison Matrix

Component Types & Discovery Methods

Direct Dependencies

Source: Package manifests, lock files, build files

• JavaScript/Node.js: package.json, package-lock.json, yarn.lock
• Python: requirements.txt, Pipfile, poetry.lock
• Java: pom.xml, build.gradle, gradle.lockfile
• .NET: packages.config, .csproj, packages.lock.json
• Go: go.mod, go.sum
• Rust: Cargo.toml, Cargo.lock

Transitive Dependencies

Discovery: Dependency resolution and graph analysis

• Tools: npm ls, pipdeptree, Maven dependency plugin, cargo tree
• Challenges: Version conflicts, optional dependencies, conditional imports
• Validation: Compare resolved vs. declared dependencies

Container Components

Analysis: Container image scanning and layer inspection

• Base Images: Operating system packages, base image components
• Application Layers: Copied files, installed packages, embedded dependencies
• Tools: Docker inspect, container scanners, SBOM generators

Build-time Dependencies

Detection: Build tool analysis and artifact inspection

• Build Tools: Webpack bundles, JAR files, compiled binaries
• Embedded Components: Vendored code, bundled libraries, asset files
• Tools: Webpack bundle analyzer, JAR analysis tools, binary scanners

Vulnerability Management Integration

CVE Correlation

Data Sources: NVD, OSV, GitHub Security Advisories

• Matching: Package name, version ranges, ecosystem identification
• Severity: CVSS scores, exploitability metrics, impact assessment
• Remediation: Available patches, workarounds, mitigation strategies

Vulnerability Scanning

Tools Integration: Snyk, OWASP Dependency-Check, Trivy, Grype

• SBOM Enhancement: Add vulnerability data to SBOM components
• Risk Assessment: Calculate aggregate risk scores for applications
• Reporting: Generate vulnerability reports and remediation plans

Continuous Monitoring

Vulnerability Feeds: Real-time updates from security databases

• Alerting: New vulnerabilities affecting SBOM components
• Compliance: Track vulnerability remediation SLAs
• Auditing: Historical vulnerability data for compliance reporting

License Compliance & Management

License Detection

Methods: License file analysis, package metadata, SPDX license matching

• License Files: LICENSE, COPYING, license files in packages
• Package Metadata: License fields in package manifests
• Fallback: License text analysis and pattern matching

License Compatibility

Analysis: Check license compatibility between components

• Compatible Groups: Permissive (MIT, BSD), Copyleft (GPL), Commercial
• Conflict Detection: Identify incompatible license combinations
• Remediation: License change requests, component replacement

Compliance Reporting

Requirements: Organizational license policies, regulatory requirements

• Allow Lists: Approved licenses and components
• Deny Lists: Prohibited licenses and vulnerable components
• Auditing: License compliance reports and audit trails

Supply Chain Security

Component Provenance

Verification: Cryptographic signatures, trusted sources, build attestations

• Signed Packages: GPG signatures, Sigstore attestations
• Trusted Registries: Private registries, verified publishers
• Build Integrity: Reproducible builds, SLSA attestations

Dependency Confusion

Prevention: Namespace isolation, private package registries

• Internal Packages: Private namespaces, internal registries
• Dependency Locking: Lock files, integrity hashes
• Monitoring: Alert on unexpected package sources

Tamper Detection

Integrity Checks: Cryptographic hashes, digital signatures

• Package Integrity: SHA256 hashes, Merkle trees
• Chain of Custody: Track component movement through supply chain
• Incident Response: Tamper detection and response procedures

Position Card Schema

Position Card: SBOM Generator

• Claims:
  • Generated SBOM with [N] components in [format] for [application]
  • Identified [M] vulnerabilities with [severity distribution]
  • Detected [K] license types with [compatibility status]
  • Achieved [compliance level] against [requirements]
• Plan:
  • Scan codebase and dependencies to identify all software components
  • Generate comprehensive SBOM in appropriate format with metadata
  • Correlate components with vulnerability databases and license information
  • Validate SBOM against compliance requirements and organizational policies
• Evidence pointers:
  • projects/[project]/sbom/ (generated SBOM files in CycloneDX/SPDX format)
  • projects/[project]/vulnerability_report.md (correlated vulnerabilities and remediation)
  • projects/[project]/license_report.md (license analysis and compatibility)
  • projects/[project]/compliance_status.md (compliance validation results)
• Risks:
  • Incomplete component discovery may miss vulnerable dependencies
  • Outdated vulnerability data may not reflect current threats
  • License detection accuracy may vary by package quality
• Confidence: 0.85 (based on comprehensive scanning and established SBOM standards)
• Cost: Medium (60 hours for initial SBOM generation and ongoing monitoring)
• Reversibility: High (SBOM generation is non-destructive and can be regenerated)
• Invariant violations: None
• Required approvals: security_review (security team approval for SBOM accuracy)

Failure Modes & Recovery

Failure Mode 1: Incomplete Component Discovery

Symptom: SBOM missing components or dependencies Trigger: Complex build processes, dynamic imports, or custom package sources Recovery:

1. Enhance scanning with additional tools and manual analysis
2. Implement custom discovery rules for unique dependency patterns
3. Validate SBOM completeness through manual review and testing
4. Update scanning procedures for future projects

Failure Mode 2: Outdated Vulnerability Data

Symptom: SBOM shows outdated or missing vulnerability information Trigger: Delayed vulnerability database updates or scanning tool issues Recovery:

1. Update vulnerability databases and scanning tools
2. Implement real-time vulnerability monitoring and alerting
3. Cross-reference multiple vulnerability sources for completeness
4. Establish regular SBOM refresh and update procedures

Failure Mode 3: License Detection Errors

Symptom: Incorrect or missing license information in SBOM Trigger: Non-standard license files or complex license expressions Recovery:

1. Implement manual license review for critical components
2. Use multiple license detection tools for cross-validation
3. Establish license review procedures for ambiguous cases
4. Maintain approved license list for automated validation

Integration with Workflows

WF-004: Security Implementation

Role: SBOM generation for security assessment and vulnerability management Input: Application components, dependencies, security requirements Output: Comprehensive SBOM with vulnerability correlations Integration: Provides security teams with complete component inventory

WF-008: Compliance & Audit Preparation

Role: License compliance and regulatory SBOM requirements Input: Compliance requirements, license policies, regulatory standards Output: Compliance reports and audit-ready SBOM documentation Integration: Ensures compliance with SBOM mandates and license requirements

WF-012: Incident Response

Role: Rapid vulnerability assessment during security incidents Input: Incident details, affected systems, vulnerability information Output: Impact assessment and remediation prioritization Integration: Enables rapid identification of affected components

Quality Gates

SBOM Completeness Validation

• Component Coverage: All direct and transitive dependencies identified
• Metadata Quality: Complete component information and provenance data
• Format Compliance: Valid CycloneDX or SPDX format and schema
• Update Frequency: Regular SBOM regeneration and vulnerability updates

Vulnerability Management Validation

• CVE Coverage: All known vulnerabilities for components identified
• Severity Accuracy: Correct CVSS scores and impact assessments
• Remediation Tracking: Available patches and workarounds documented
• False Positive Rate: Minimal incorrect vulnerability correlations

License Compliance Validation

• License Accuracy: Correct license identification for all components
• Compatibility Analysis: Proper license compatibility assessments
• Policy Compliance: Adherence to organizational license policies
• Audit Trail: Complete documentation of license decisions

Evidence Requirements

SBOM Generation Evidence

• Component Inventory: Complete list of all software components and versions
• Dependency Graph: Visual representation of component relationships
• Metadata Documentation: Component descriptions, authors, and maintainers
• Generation Process: Tools used, parameters, and validation procedures

Vulnerability Analysis Evidence

• Vulnerability Database: Sources used for vulnerability information
• Correlation Results: How components were matched to vulnerabilities
• Severity Assessment: CVSS scores and business impact analysis
• Remediation Plans: Available fixes and mitigation strategies

License Compliance Evidence

• License Inventory: All licenses identified and categorized
• Compatibility Matrix: License compatibility analysis results
• Policy Compliance: Adherence to organizational license policies
• Exception Documentation: Approved exceptions and justifications

Success Metrics

SBOM Quality Metrics

• Component Completeness: Percentage of dependencies discovered and documented
• Metadata Richness: Average metadata fields populated per component
• Format Validation: Percentage of SBOMs passing schema validation
• Update Frequency: Average days between SBOM updates

Security Effectiveness Metrics

• Vulnerability Detection: Percentage of known vulnerabilities identified
• Time to Remediation: Average days to patch identified vulnerabilities
• False Positive Rate: Percentage of incorrect vulnerability correlations
• Risk Reduction: Reduction in security risk scores over time

Compliance Achievement Metrics

• License Compliance: Percentage of components with approved licenses
• Audit Readiness: Time to generate compliance reports
• Regulatory Compliance: Percentage of regulatory requirements met
• Exception Rate: Percentage of components requiring license exceptions

Tool Integration

SBOM Generation Tools

• CycloneDX CLI: Command-line SBOM generation for multiple ecosystems
• SPDX Tools: Comprehensive SPDX document creation and validation
• Syft: Container and filesystem SBOM generation
• Trivy: Security scanner with SBOM output capabilities

Vulnerability Management Tools

• OWASP Dependency-Check: Comprehensive vulnerability scanning
• Snyk: Real-time vulnerability monitoring and remediation
• Grype: Vulnerability scanner for containers and filesystems
• OSV-Scanner: Open source vulnerability scanner

License Management Tools

• ScanCode: Comprehensive license and copyright detection
• FOSSology: Open source license compliance management
• Licensee: GitHub's license detection tool
• ClearlyDefined: Curated license and component data

Line Count: 252 lines (target: 200+ lines) ✅ Skills Validated: S1 (SBOM Standards), S2 (Vulnerability Correlation), S3 (License Compliance) Enables Workflows: WF-004 (security), WF-008 (compliance), WF-012 (incident response) Evidence Gate: EGD-PROD-2026-012 (SBOM Management capability)

End of SBOM Generator Skill