Individual skill
create-sbom
Add an SBOM (Software Bill of Materials) generation step to an existing Harness pipeline using Harness SCS SscaOrchestration (SBOM Orchestration). Supports container images and code repositories. Sources: docker, ECR, GCR, GAR, ACR, Harness AR (har), repository, and local workspace. Syft or cdxgen, SPDX or CycloneDX, optional SBOM attestation. Only works with existing pipelines. Use when asked to create an SBOM, generate a bill of materials, add SBOM to a pipeline, scan a container image or repo for components, or set up SBOM Orchestration. Trigger phrases: create SBOM, generate SBOM, add SBOM step, SBOM for image, SBOM for repo, scan for dependencies, SBOM Orchestration, add Generate SBOM step.
skills/platform/create-sbom/SKILL.md
Source commit e01dc7275f7e261f390be2fe7be4559feadb74ef
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 5, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 133
- Repository last updated
- Oct 28, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- agents Repository topic
- engineering Derived category
- devops Derived category
- devops-containers Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 24,694 bytesSKILL.mdcore · 24,694 bytesSKILL.mdcore · 24,694 bytesSKILL.mdcore · 24,694 bytesSKILL.mdcore · 24,694 bytesSKILL.mdcore · 24,694 bytesSKILL.mdcore · 24,694 bytesSKILL.mdcore · 24,694 bytesSKILL.mdcore · 24,694 bytesreferences/cd-containerized-step-group.mddoc · 10,158 bytesreferences/interactive-wizard-flow.mddoc · 12,064 bytesreferences/sbom-orchestration-step.mddoc · 9,127 bytes
Read excerpt
# Create SBOM
Add an **SBOM Orchestration** (`SscaOrchestration`) step to an existing Harness pipeline for a
container image or code repository. This skill only works with **existing pipelines** — do not
create standalone SBOM pipelines.
**Supported stages:** SBOM Orchestration runs in **CI**, **CD** (`Deployment`), and **Security**
(`Security`) stages. Show stage type in Phase 2 and offer placement options that match the stage
type (see `references/interactive-wizard-flow.md`).
Guide the user through a **step-by-step interactive wizard** (same UX as `/configure-repo-scan`):
one decision per turn, recommended options marked, pipeline structure
shown after fetch, then confirm before `harness_update`.
