Individual skill
bom-convert-validate
Converts CycloneDX BOMs to SPDX 3.0.1 JSON-LD or between CycloneDX spec versions with cdx-convert, and validates BOMs against JSON schema, deep consistency checks, and OWASP SCVS and EU Cyber Resilience Act compliance benchmarks with cdx-validate, emitting SARIF for code scanning. Use when asked to convert an SBOM to SPDX, downgrade or upgrade a BOM spec version, validate or lint a BOM, check SCVS or CRA compliance, or score SBOM quality.
agent-plugin/skills/bom-convert-validate/SKILL.md
Source commit b0994ca9e4549ac8f3a50ed46afe78580f02c1a0
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 3, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,109
- Repository last updated
- Nov 8, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- bom Repository topic
- sca Repository topic
- cyclonedx Repository topic
- sbom Repository topic
- docker Repository topic
- oci Repository topic
- containers Repository topic
- owasp Repository topic
- package-url Repository topic
- purl Repository topic
- legal Derived category
- security Derived category
- security-application Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# Convert and validate BOMs
Two post-processing commands for BOMs that already exist.
Read [reference/safety.md](../../reference/safety.md) first.
## Convert
```bash
# CycloneDX to SPDX 3.0.1 JSON-LD (default target)
cdx-convert -i /absolute/path/to/bom.json -o /absolute/path/to/bom.spdx.json
# Cross-convert between CycloneDX spec versions
cdx-convert -i /absolute/path/to/bom.json --to 1.6 -o /absolute/path/to/bom.1.6.json