How do I install the Yocto Security Sbom skill?

Run npx skillmds@latest add higangssh/yocto-security-sbom in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Yocto Security Sbom safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Yocto Security Sbom?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Yocto Security Sbom free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Yocto Security Sbom?

Higangssh (@higangssh) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Yocto Security Sbom by higangssh — Agent Skill

Name: Yocto Security Sbom
Author: Higangssh

Yocto Security Sbom

Review and debug Yocto license metadata, LIC_FILES_CHKSUM, LICENSE_FLAGS, incompatible licenses, license manifests, SPDX/SBOM generation, CVE checking, archiver/copyleft source compliance, and security policy. Use for compliance, CVE, SBOM, license, commercial license, source archiving, or security review questions.

Higangssh db61b64 4 files · 13.3 KB Updated Sep 17, 2026

File contents

Yocto Security SBOM

Use this skill for security, license, CVE, SBOM, and compliance workflows. Treat class names and output paths as release-sensitive.

Evidence

Ask for or inspect:

target Yocto release
recipe LICENSE and LIC_FILES_CHKSUM
license QA error
image/license manifest output
SPDX/SBOM configuration and output
CVE check configuration and reports
archiver/copyleft configuration
commercial license policy

Useful commands:

bitbake -e <recipe> | rg '^(LICENSE|LIC_FILES_CHKSUM|LICENSE_FLAGS|LICENSE_FLAGS_ACCEPTED|INCOMPATIBLE_LICENSE|CVE|SPDX|ARCHIVER)[:=]'
bitbake -c populate_lic <recipe>
bitbake <image>
find tmp/deploy -maxdepth 4 -iname '*spdx*' -o -path '*licenses*'

Review Rules

LIC_FILES_CHKSUM is mandatory unless LICENSE = "CLOSED".
License checksum mismatch means upstream license text changed; inspect before updating the checksum.
Keep commercial license acceptance explicit and narrow.
Verify current release SBOM/CVE class names before recommending create-spdx, CVE classes, or output paths.
Use archiver/copyleft flows when source offer obligations matter.
Do not confuse build-time DEPENDS with packages included in final image license manifests.

References

Read references/security-sbom.md.
Read references/classes-core.md for license, archiver, create-spdx, and release-sensitive security classes.
Read references/migration.md for SBOM/CVE release changes.

Output

Answer with:

license/security artifact being debugged
release-sensitive class or variable to verify
exact metadata or policy fix
validation command and expected artifact
compliance caveat if legal interpretation is required

---name: yocto-security-sbomdescription: Review and debug Yocto license metadata, LIC_FILES_CHKSUM, LICENSE_FLAGS, incompatible licenses, license manifests, SPDX/SBOM generation, CVE checking, archiver/copyleft source compliance, and security policy. Use for compliance, CVE, SBOM, license, commercial license, source archiving, or security review questions.---# Yocto Security SBOMUse this skill for security, license, CVE, SBOM, and compliance workflows. Treat class names and output paths as release-sensitive.## EvidenceAsk for or inspect:```texttarget Yocto releaserecipe LICENSE and LIC_FILES_CHKSUMlicense QA errorimage/license manifest outputSPDX/SBOM configuration and outputCVE check configuration and reportsarchiver/copyleft configurationcommercial license policy```Useful commands:```bashbitbake -e <recipe> | rg '^(LICENSE|LIC_FILES_CHKSUM|LICENSE_FLAGS|LICENSE_FLAGS_ACCEPTED|INCOMPATIBLE_LICENSE|CVE|SPDX|ARCHIVER)[:=]'bitbake -c populate_lic <recipe>bitbake <image>find tmp/deploy -maxdepth 4 -iname '*spdx*' -o -path '*licenses*'```## Review Rules- `LIC_FILES_CHKSUM` is mandatory unless `LICENSE = "CLOSED"`.- License checksum mismatch means upstream license text changed; inspect before updating the checksum.- Keep commercial license acceptance explicit and narrow.- Verify current release SBOM/CVE class names before recommending `create-spdx`, CVE classes, or output paths.- Use archiver/copyleft flows when source offer obligations matter.- Do not confuse build-time `DEPENDS` with packages included in final image license manifests.## References- Read [references/security-sbom.md](references/security-sbom.md).- Read [references/classes-core.md](references/classes-core.md) for `license`, `archiver`, `create-spdx`, and release-sensitive security classes.- Read [references/migration.md](references/migration.md) for SBOM/CVE release changes.## OutputAnswer with:1. license/security artifact being debugged2. release-sensitive class or variable to verify3. exact metadata or policy fix4. validation command and expected artifact5. compliance caveat if legal interpretation is required

Frequently asked questions