bom-signing

80 / 100 · Low risk

Fine to try. Some of what it can do is expected: a devops skill usually runs commands, installs tools and uses cloud credentials.

By cdxgen/cdxgen (GitHub) · devops · 1,114 stars · scanned at commit 4a45539

Signs and verifies CycloneDX BOMs using cdxgen's native JSON Signature Format (JSF) implementation via cdx-sign and cdx-verify, supporting granular component, service, and annotation signatures, parallel multi-signatures, and sequential signature chains. Use when asked to sign an SBOM, verify a BOM signature, establish BOM authenticity or non-repudiation, build an approval trail across pipeline stages, or generate signing keys.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. It runs automatically when the plugin is installed. Expected for a devops skill.

Found in 8 places.

agent-plugin/skills/bom-signing/SKILL.md, line 27cdxgen -o /absolute/path/to/bom.json --generate-key-and-sign /absolute/path/to/project
agent-plugin/skills/bom-signing/SKILL.md, line 37cdx-sign -i /absolute/path/to/bom.json -k /absolute/path/to/builder_private.pem
agent-plugin/skills/bom-signing/SKILL.md, line 73cdx-sign -i /absolute/path/to/bom.json -k /absolute/path/to/auditor_private.pem \

Show 5 more

agent-plugin/skills/bom-signing/SKILL.md, line 88cdx-sign -i /absolute/path/to/bom.json -k /absolute/path/to/approver_private.pem --mode chain \
agent-plugin/skills/bom-signing/SKILL.md, line 98cdx-verify -i /absolute/path/to/bom.json --public-key /absolute/path/to/public.pem
agent-plugin/skills/bom-signing/SKILL.md, line 127cdx-validate -i /absolute/path/to/bom.json \
agent-plugin/hooks/hooks.json, line 9"command": "node",
agent-plugin/hooks/hooks.json, line 22"command": "node",

Downloads and installs other software

The author does not mention this. It runs automatically when the plugin is installed. Expected for a devops skill.

Found in 2 places.

agent-plugin/hooks/check-cdxgen.mjs, line 102"The cdxgen plugin needs the cdxgen CLI, which is not on PATH. Install it with `npm i -g @cdxgen/cdxgen`, or use the ghcr.io/cdxgen/cdxgen image.",
agent-plugin/hooks/check-cdxgen.mjs, line 113systemMessage: `cdxgen ${installed} is older than the cdxgen plugin (${pluginVersion}). Some skill instructions may use options it lacks. Update with \`npm i -g

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'bom-signing' ] || [ -L ~/.agents/skills/'bom-signing' ]; then echo 'A skill folder named bom-signing already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/cdxgen/cdxgen' "$d" && git -C "$d" checkout --quiet '4a45539a204af65f511000eeeec26f479cb48565' -- 'agent-plugin/skills/bom-signing' && mkdir -p ~/.agents/skills && cp -R "$d"/'agent-plugin/skills/bom-signing' ~/.agents/skills/'bom-signing' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'bom-signing' ~/.claude/skills/'bom-signing' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for cdxgen/cdxgen shows the score of its lowest-scoring skill.

SkillTrust badge for cdxgen/cdxgen

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/cdxgen/cdxgen.svg)](https://zalavijaysinh.github.io/skilltrust/repos/cdxgen/cdxgen/)

Score history

Date	Version	Score
2026-11-12	`4a45539`	80