Individual skill
container-sbom
Generates CycloneDX BOMs for container images, OCI archives, mounted root filesystems, Electron ASAR archives, caxa executables, binaries, and Kubernetes or Dockerfile manifests using OWASP cdxgen post-build scanning. Use when asked to scan a Docker or OCI image, produce an SBOM for a container or golden image, inventory a rootfs, audit a packaged Electron app, or analyse Dockerfiles and Kubernetes manifests.
agent-plugin/skills/container-sbom/SKILL.md
Source commit b0994ca9e4549ac8f3a50ed46afe78580f02c1a0
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 3, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,108
- Repository last updated
- Nov 8, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- bom Repository topic
- sca Repository topic
- cyclonedx Repository topic
- sbom Repository topic
- docker Repository topic
- oci Repository topic
- containers Repository topic
- owasp Repository topic
- package-url Repository topic
- purl Repository topic
- devops Derived category
- security Derived category
- devops-containers Derived category
- security-application Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytesSKILL.mdcore · 7,294 bytes
Read excerpt
# Container, image, and binary BOMs
Use this skill when the target is a built artifact rather than a source tree.
For source repositories use `sbom-generate`; for a live running host use
`os-hardware-inventory`.
Read [reference/safety.md](../../reference/safety.md) first.
## Plugin settings
Claude Code replaces the `${user_config.*}` values in this table with the
options the user set for the plugin. Other clients show the text as written. A
value counts as set only when it is not empty and does not start with `${`;
otherwise ignore it and follow the "When not set" column. The settings hold no