New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Bom Signing

by cdxgen in cdxgen/cdxgen

Signs and verifies CycloneDX BOMs using cdxgen's native JSON Signature Format (JSF) implementation via cdx-sign and cdx-verify, supporting granular component, service, and annotation signatures…

Apache-2.0Auto-check passedSecurity

Install Bom Signing

skills CLI
$ npx skills add cdxgen/cdxgen --skill bom-signing -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install cdxgen/cdxgen bom-signing --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/cdxgen/cdxgen.git skills-src && mkdir -p .claude/skills && cp -r skills-src/claude-plugin/skills/bom-signing .claude/skills/bom-signing && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
bom-signing
GitHub stars
1.1k
Token cost
~1.5k tokens
SKILL.md length
478 words
Files
1
Skills in repo
17
Repo updated
First seen
Licence
Apache-2.0

At a glance

Signs and verifies CycloneDX BOMs using cdxgen's native JSON Signature Format (JSF) implementation via cdx-sign and cdx-verify, supporting granular component, service, and annotation signatures…

  • Asked to sign an SBOM
  • SKILL.md covers Key handling boundary, Sign, Choosing a signature mode and Verify, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Verify a BOM signature

What it does

Bom Signing is an agent skill from cdxgen/cdxgen. Signs and verifies CycloneDX BOMs using cdxgen's native JSON Signature Format (JSF) implementation via cdx-sign and cdx-verify, supporting granular component, service, and annotation signatures, parallel multi-signatures, and sequential signature chains. Use when asked to sign an SBOM, verify a BOM signature, establish BOM authenticity or non-repudiation, build an approval trail across pipeline stages, or generate signing keys.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Supply chain security. The repository describes itself as: Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with…. The licence is Apache-2.0.

When your agent uses it

  • Asked to sign an SBOM
  • Verify a BOM signature
  • Establish BOM authenticity
  • Non-repudiation

Example prompts

  • “Use the bom-signing skill to sign and verifies CycloneDX BOMs using cdxgen's native JSON Signature Format (JSF) implementation via cdx-sign and…”
  • “/bom-signing”

What it can do on your machine

Read from SKILL.md and the folder at commit e256966. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • cdxgen.github.io

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Bom Signing loads about 1.5k tokens when it runs. Until then it costs about 111 tokens; SKILL.md has 478 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~111
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from cdxgen/cdxgen at commit e256966, republished under its Apache-2.0 licence (© cdxgen). 478 words, ~1,516 tokens.

Download SKILL.mdSave it as .claude/skills/bom-signing/SKILL.md (or your agent's skills folder).
name
bom-signing
description
Signs and verifies CycloneDX BOMs using cdxgen's native JSON Signature Format (JSF) implementation via cdx-sign and cdx-verify, supporting granular component, service, and annotation signatures, parallel multi-signatures, and sequential signature chains. Use when asked to sign an SBOM, verify a BOM signature, establish BOM authenticity or non-repudiation, build an approval trail across pipeline stages, or generate signing keys.

Sign and verify BOMs

cdxgen ships a native JSON Signature Format (JSF) implementation that goes beyond a single document-level signature. It supports granular signatures over individual components, services, and annotations; parallel multi-signatures via signers; and sequential signature chains via chain.

Read reference/safety.md first.

Key handling boundary

Never generate, read, paste, or transcribe private key material yourself, and never enter a passphrase on the user's behalf. Run the signing commands with paths the user provides, and if a key does not exist yet, give the user the command to create it and let them run it.

For a throwaway demo or test BOM, cdxgen can generate a keypair and sign in one step:

bash
cdxgen -o /absolute/path/to/bom.json --generate-key-and-sign /absolute/path/to/project

This is appropriate for testing signing workflows. It is not appropriate for release signing, where the key should come from the user's key management.

Sign

bash
# Replace or create the root signature in place
cdx-sign -i /absolute/path/to/bom.json -k /absolute/path/to/builder_private.pem

# Write a signed copy to a new file, with an explicit algorithm
cdx-sign -i /absolute/path/to/bom.json -o /absolute/path/to/bom.signed.json \
  -k /absolute/path/to/builder_private.pem -a RS512
FlagPurpose
-i, --inputBOM to sign
-o, --outputSigned copy; omit to sign in place
-k, --private-keyPrivate key, PEM format
-a, --algorithmJSF algorithm; default RS512. Also ES256, Ed25519
-m, --modereplace (default), signers, chain
--key-idKey identifier recorded in the signature
--sign-componentsSign individual components
--sign-servicesSign individual services
--sign-annotationsSign annotations
--attachAttach the signature rather than replacing

Defaults can come from SBOM_SIGN_ALGORITHM and SBOM_SIGN_MODE.

Choosing a signature mode

ModeSemanticsUse for
replaceReplaces or creates the root signatureBuild-time signing by the producer
signersAppends a parallel signature without replacing existing onesIndependent approvals from different teams
chainAppends to a sequential signature historyAn ordered approval trail through pipeline stages

Append a security review signature without destroying the builder's:

bash
cdx-sign -i /absolute/path/to/bom.json -k /absolute/path/to/auditor_private.pem \
  --mode signers --no-sign-components --no-sign-services --no-sign-annotations

Note the --no- prefixes: the reviewer signs the document, not every component, which keeps the second signature cheap and its scope clear.

Build a chained history:

bash
cdx-sign -i /absolute/path/to/bom.json -k /absolute/path/to/approver_private.pem --mode chain

Use signers when approvals are independent and order does not matter. Use chain when the order is itself the evidence.

Show full SKILL.md (169 more words)Show less

Verify

bash
cdx-verify -i /absolute/path/to/bom.json --public-key /absolute/path/to/public.pem
cdx-verify -i /absolute/path/to/bom.json --public-key /absolute/path/to/public.pem --deep

--deep verifies granular component, service, and annotation signatures rather than only the document signature. Use it whenever the BOM was signed with --sign-components or --sign-services — a passing shallow check on such a BOM does not establish that the component signatures are intact.

--platform targets platform-specific verification behaviour.

Verify structure and signature together

cdx-validate folds signature verification into full validation (JSON input only):

bash
cdx-validate -i /absolute/path/to/bom.json \
  --public-key /absolute/path/to/public.pem --require-signature

--require-signature makes an unsigned BOM a validation failure rather than a silent pass. Prefer this in release gates. See bom-convert-validate.

Reporting verification results

Be precise about what a result does and does not establish:

  • A valid signature proves the BOM was signed by the holder of that key and has not been altered since. It says nothing about whether the BOM's contents are accurate.
  • A shallow pass on a granularly signed BOM is not a full verification. Say when you did not run --deep.
  • An unsigned BOM is not a failed signature. Distinguish "no signature present" from "signature invalid".

Reference

© cdxgen, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in claude-plugin/skills/bom-signing of cdxgen/cdxgen.

Open the folder on GitHubat commit e256966

Compare with similar skills

Bom Signing next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Bom Signing compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Bom Signing this skillcdxgen/cdxgen1.1k—~1.5kAutomated safety check: PassApache-2.0
Skill Scannergetsentry/skills1k4 repos~2.5kAutomated safety check: WarnApache-2.0
Serenity Aleabitoreddityan-labs/serenity-aleabitoreddit4811 repos~3.3kAutomated safety check: PassNone
Eu CraSushegaad/Claude-Skills-Governance-Risk-and-Compliance9431 repos~4kAutomated safety check: PassMIT
Kesekit Checkcdppcorp/KESE-KIT361—~1.3kAutomated safety check: PassMIT
Packslipjdx/packslip136—~2.9kAutomated safety check: PassMIT

Similar skills

  • Skill Scanner

    getsentry/skills

    Official

    Scan agent skills for security issues. An agent skill from getsentry/skills.

    1k GitHub starsUsed in 4 repos~2.5k tokens
    SecurityAuto-check: warnings

  • Serenity Aleabitoreddit

    yan-labs/serenity-aleabitoreddit

    Apply trader Serenity's (@aleabitoreddit) AI/semiconductor supply-chain analytical lens to US-stock ideas and market judgment.

    481 GitHub starsUsed in 1 repo~3.3k tokens
    SecurityAuto-check passed

  • Eu Cra

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the…

    943 GitHub starsUsed in 1 repo~4k tokens
    SecurityAuto-check passed

  • Kesekit Check

    cdppcorp/KESE-KIT

    Run a pre-deployment security compliance checklist based on KISA guidelines.

    361 GitHub stars~1.3k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Packslip

    jdx/packslip

    Configure signed release manifests with packslip: add the jdx/packslip action or packslip create to a release workflow, declare completions, man pages, CLI specs, skills, and SBOMs as resources, and…

    136 GitHub stars~2.9k tokensUpdated today
    SecurityAuto-check passed

  • Vex Authoring

    relizaio/rearm

    Author CycloneDX-VEX or OpenVEX documents that import cleanly into ReARM.

    127 GitHub stars~2.9k tokensUpdated yesterday
    SecurityAuto-check passed

More from cdxgen/cdxgen

All 17 skills in this repo

  • AI Bom

    cdxgen/cdxgen

    Generates AI-BOM, MCP inventory, AI skill inventory, and AI authorship provenance documents with cdxgen, cataloging models, inference services, Hugging Face purls, MCP servers and their…

    1.1k GitHub stars~2.5k tokensUpdated yesterday
    Auto-check passed

  • Bom Audit

    cdxgen/cdxgen

    Runs supply-chain risk analysis on CycloneDX BOMs with cdx-audit predictive auditing and cdxgen --bom-audit embedded rules, covering npm and PyPI package compromise posture, CI permission risk…

    1.1k GitHub stars~2.4k tokensUpdated yesterday
    Auto-check passed

  • Bom Evidence

    cdxgen/cdxgen

    Enriches an existing CycloneDX BOM with occurrence, callstack, reachability, data-flow, and crypto-flow evidence using cdxgen evinse, including Go analysis via Golem and Rust analysis via Rusi, and…

    1.1k GitHub stars~1.9k tokensUpdated yesterday
    Auto-check passed

  • Bom Explore

    cdxgen/cdxgen

    Explores and triages a CycloneDX BOM interactively with the cdxi REPL, using built-in commands for dependency trees, licenses, services, cryptographic assets, audit findings, evidence occurrences…

    1.1k GitHub stars~1.2k tokensUpdated yesterday
    Auto-check passed

  • Bom Convert Validate

    cdxgen/cdxgen

    Converts CycloneDX BOMs to SPDX 3.0.1 JSON-LD or between CycloneDX spec versions with cdx-convert, and validates BOMs against JSON schema, deep consistency checks, and OWASP SCVS and EU Cyber…

    1.1k GitHub stars~1.5k tokensUpdated yesterday
    Auto-check: warnings

  • Bom Slimmer

    cdxgen/cdxgen

    Reviews a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using cdxgen SBOM evidence, occurrence/callstack usage data, and license and…

    1.1k GitHub stars~1.6k tokensUpdated yesterday
    Auto-check passed

Categories

Questions about Bom Signing

What does Bom Signing do?

Signs and verifies CycloneDX BOMs using cdxgen's native JSON Signature Format (JSF) implementation via cdx-sign and cdx-verify, supporting granular component, service, and annotation signatures…. Bom Signing is an agent skill from cdxgen/cdxgen. Signs and verifies CycloneDX BOMs using cdxgen's native JSON Signature Format (JSF) implementation via cdx-sign and cdx-verify, supporting granular component, service, and annotation signatures, parallel multi-signatures, and sequential signature chains.

When should I use Bom Signing?

Bom Signing fits situations like: asked to sign an SBOM; verify a BOM signature; establish BOM authenticity; non-repudiation.

How do I install Bom Signing in Claude Code?

Run `npx skills add cdxgen/cdxgen --skill bom-signing -a claude-code`. Or copy the skill folder (claude-plugin/skills/bom-signing in cdxgen/cdxgen) into .claude/skills/bom-signing in your project. Claude Code loads it when a task matches its description.

How do I install Bom Signing in Codex?

Run `npx skills add cdxgen/cdxgen --skill bom-signing -a codex`. Or copy the skill folder (claude-plugin/skills/bom-signing in cdxgen/cdxgen) into .agents/skills/bom-signing in your project. Codex loads it when a task matches its description.

Can I use Bom Signing in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cdxgen/cdxgen --skill bom-signing -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/bom-signing, .gemini/skills/bom-signing, .github/skills/bom-signing and .opencode/skills/bom-signing in your project.

What does Bom Signing need to run?

SKILL.md names no scripts, command-line tools or credentials: Bom Signing is instructions for the agent only.

Does Bom Signing access the network?

SKILL.md names 1 domain. As links in the text: cdxgen.github.io. This is read from the text; nothing was executed.

Is Bom Signing safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Bom Signing use?

Bom Signing is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Bom Signing use?

About 1.5k tokens (SKILL.md is roughly 6.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Bom Signing?

Skills that share tags, products or a category with Bom Signing: Skill Scanner (getsentry/skills, 1k stars), Serenity Aleabitoreddit (yan-labs/serenity-aleabitoreddit, 481 stars), Eu Cra (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 943 stars) and Kesekit Check (cdppcorp/KESE-KIT, 361 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Bom Signing?

cdxgen (a GitHub organization) maintains it in cdxgen/cdxgen, which has 1,085 GitHub stars. The repository holds 17 skills in this directory. The repository was last updated on October 8, 2026.

Source: cdxgen/cdxgen on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.