container-sbom

80 / 100 · Low risk

Fine to try. Some of what it can do is expected: a devops skill usually runs commands, installs tools and uses cloud credentials.

By cdxgen/cdxgen (GitHub) · devops · 1,114 stars · scanned at commit 4a45539

Generates CycloneDX BOMs for container images, OCI archives, mounted root filesystems, Electron ASAR archives, caxa executables, binaries, and Kubernetes or Dockerfile manifests using OWASP cdxgen post-build scanning. Use when asked to scan a Docker or OCI image, produce an SBOM for a container or golden image, inventory a rootfs, audit a packaged Electron app, or analyse Dockerfiles and Kubernetes manifests.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. It runs automatically when the plugin is installed. Expected for a devops skill.

Found in 11 places.

agent-plugin/skills/container-sbom/SKILL.md, line 35cdxgen -t docker myimage:latest -o /absolute/path/to/bom.json
agent-plugin/skills/container-sbom/SKILL.md, line 45cdxgen -t oci --lifecycle post-build myimage:latest -o /absolute/path/to/bom.json
agent-plugin/skills/container-sbom/SKILL.md, line 51cdxgen /absolute/path/to/rootfs -t rootfs -o /absolute/path/to/bom.json

Show 8 more

agent-plugin/skills/container-sbom/SKILL.md, line 58cdxgen /absolute/path/to/rootfs -t rootfs \
agent-plugin/skills/container-sbom/SKILL.md, line 97cdxgen -t asar /absolute/path/to/app.asar \
agent-plugin/skills/container-sbom/SKILL.md, line 110cdxgen -t caxa /absolute/path/to/dir-with-metadata -o /absolute/path/to/bom.json
agent-plugin/skills/container-sbom/SKILL.md, line 127cdxgen -t go /absolute/path/to/compiled-binary -o /absolute/path/to/bom.json
agent-plugin/skills/container-sbom/SKILL.md, line 138cdxgen -t containerfile /absolute/path/to/project -o /absolute/path/to/bom.json
agent-plugin/skills/container-sbom/SKILL.md, line 150cdxgen -t oci myimage:latest \
agent-plugin/hooks/hooks.json, line 9"command": "node",
agent-plugin/hooks/hooks.json, line 22"command": "node",

Downloads and installs other software

The author does not mention this. It runs automatically when the plugin is installed. Expected for a devops skill.

Found in 2 places.

agent-plugin/hooks/check-cdxgen.mjs, line 102"The cdxgen plugin needs the cdxgen CLI, which is not on PATH. Install it with `npm i -g @cdxgen/cdxgen`, or use the ghcr.io/cdxgen/cdxgen image.",
agent-plugin/hooks/check-cdxgen.mjs, line 113systemMessage: `cdxgen ${installed} is older than the cdxgen plugin (${pluginVersion}). Some skill instructions may use options it lacks. Update with \`npm i -g

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'container-sbom' ] || [ -L ~/.agents/skills/'container-sbom' ]; then echo 'A skill folder named container-sbom already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/cdxgen/cdxgen' "$d" && git -C "$d" checkout --quiet '4a45539a204af65f511000eeeec26f479cb48565' -- 'agent-plugin/skills/container-sbom' && mkdir -p ~/.agents/skills && cp -R "$d"/'agent-plugin/skills/container-sbom' ~/.agents/skills/'container-sbom' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'container-sbom' ~/.claude/skills/'container-sbom' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for cdxgen/cdxgen shows the score of its lowest-scoring skill.

SkillTrust badge for cdxgen/cdxgen

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/cdxgen/cdxgen.svg)](https://zalavijaysinh.github.io/skilltrust/repos/cdxgen/cdxgen/)

Score history

Date	Version	Score
2026-11-12	`4a45539`	80