bom-audit

80 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By cdxgen/cdxgen (GitHub) · security · 1,114 stars · scanned at commit 4a45539

Runs supply-chain risk analysis on CycloneDX BOMs with cdx-audit predictive auditing and cdxgen --bom-audit embedded rules, covering npm and PyPI package compromise posture, CI permission risk, dependency source integrity, license policy violations, and SARIF or JSON reporting for code scanning. Use when asked to audit an SBOM, assess supply-chain or dependency risk, check for compromised or malicious packages, triage which dependencies to review first, or produce SARIF from a BOM.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. It runs automatically when the plugin is installed. Expected for a security skill.

Found in 10 places.

agent-plugin/skills/bom-audit/SKILL.md, line 24cdx-audit --bom /absolute/path/to/bom.json
agent-plugin/skills/bom-audit/SKILL.md, line 45cdx-audit --bom /absolute/path/to/bom.json --scope required --max-targets 25
agent-plugin/skills/bom-audit/SKILL.md, line 60cdx-audit --bom /absolute/path/to/bom.json --scope required --include-trusted --max-targets 50

Show 7 more

agent-plugin/skills/bom-audit/SKILL.md, line 72cdx-audit --bom /absolute/path/to/bom.json \
agent-plugin/skills/bom-audit/SKILL.md, line 104CDXGEN_THINK_MODE=true cdx-audit --bom /absolute/path/to/bom.json --scope required --max-targets 10
agent-plugin/skills/bom-audit/SKILL.md, line 115cdx-audit --bom /absolute/path/to/bom.json --direct-bom-audit
agent-plugin/skills/bom-audit/SKILL.md, line 129cdxgen -o /absolute/path/to/bom.json --bom-audit /absolute/path/to/project
agent-plugin/skills/bom-audit/SKILL.md, line 174cdx-audit --bom /absolute/path/to/bom.json --license-policy /absolute/path/to/policy.yaml
agent-plugin/hooks/hooks.json, line 9"command": "node",
agent-plugin/hooks/hooks.json, line 22"command": "node",

Downloads and installs other software

The author does not mention this. It runs automatically when the plugin is installed.

Found in 2 places.

agent-plugin/hooks/check-cdxgen.mjs, line 102"The cdxgen plugin needs the cdxgen CLI, which is not on PATH. Install it with `npm i -g @cdxgen/cdxgen`, or use the ghcr.io/cdxgen/cdxgen image.",
agent-plugin/hooks/check-cdxgen.mjs, line 113systemMessage: `cdxgen ${installed} is older than the cdxgen plugin (${pluginVersion}). Some skill instructions may use options it lacks. Update with \`npm i -g

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'bom-audit' ] || [ -L ~/.agents/skills/'bom-audit' ]; then echo 'A skill folder named bom-audit already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/cdxgen/cdxgen' "$d" && git -C "$d" checkout --quiet '4a45539a204af65f511000eeeec26f479cb48565' -- 'agent-plugin/skills/bom-audit' && mkdir -p ~/.agents/skills && cp -R "$d"/'agent-plugin/skills/bom-audit' ~/.agents/skills/'bom-audit' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'bom-audit' ~/.claude/skills/'bom-audit' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for cdxgen/cdxgen shows the score of its lowest-scoring skill.

SkillTrust badge for cdxgen/cdxgen

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/cdxgen/cdxgen.svg)](https://zalavijaysinh.github.io/skilltrust/repos/cdxgen/cdxgen/)

Score history

Date	Version	Score
2026-11-12	`4a45539`	80