New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Bom Slimmer

by cdxgen in cdxgen/cdxgen

Reviews a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using cdxgen SBOM evidence, occurrence/callstack usage data, and license and…

Apache-2.0Auto-check passedSecurity

Install Bom Slimmer

skills CLI
$ npx skills add cdxgen/cdxgen --skill bom-slimmer -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install cdxgen/cdxgen bom-slimmer --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/cdxgen/cdxgen.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/bom-slimmer .claude/skills/bom-slimmer && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
bom-slimmer
GitHub stars
1.1k
Token cost
~1.6k tokens
SKILL.md length
689 words
Files
1
Skills in repo
17
Repo updated
First seen
Licence
Apache-2.0

At a glance

Reviews a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using cdxgen SBOM evidence, occurrence/callstack usage data, and license and…

  • Works in 4 steps: Using cdxgen SBOM as the Authoritative… → Advanced Analysis Data Points → Step-by-Step Analysis Workflow → …
  • Asked to shrink nodemodules
  • SKILL.md covers 1. Using cdxgen SBOM as the…, 2. Advanced Analysis Data Points, 3. Step-by-Step Analysis… and 4. Risk Assessment Guide
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Bom Slimmer is an agent skill from cdxgen/cdxgen. Reviews a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using cdxgen SBOM evidence, occurrence/callstack usage data, and license and supply-chain risk evaluation. Use when asked to shrink nodemodules, reduce dependency bloat or copyleft exposure, or replace utility packages with native or built-in implementations.

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Supply chain security and Regulatory compliance. The repository describes itself as: Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with…. The licence is Apache-2.0.

When your agent uses it

  • Asked to shrink nodemodules
  • Reduce dependency bloat
  • Copyleft exposure
  • Replace utility packages with native

Example prompts

  • “Use the bom-slimmer skill to review a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using…”
  • “/bom-slimmer”

Requirements

  • Node.js

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Using cdxgen SBOM as the Authoritative Data Source
  2. Advanced Analysis Data Points
  3. Step-by-Step Analysis Workflow
  4. Risk Assessment Guide

What it can do on your machine

Read from SKILL.md and the folder at commit e256966. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are json).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Bom Slimmer loads about 1.6k tokens when it runs. Until then it costs about 96 tokens; SKILL.md has 689 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~96
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from cdxgen/cdxgen at commit e256966, republished under its Apache-2.0 licence (© cdxgen). 689 words, ~1,584 tokens.

Download SKILL.mdSave it as .claude/skills/bom-slimmer/SKILL.md (or your agent's skills folder).
name
bom-slimmer
description
Reviews a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using cdxgen SBOM evidence, occurrence/callstack usage data, and license and supply-chain risk evaluation. Use when asked to shrink node_modules, reduce dependency bloat or copyleft exposure, or replace utility packages with native or built-in implementations.

Skill: BOM Slimmer

This skill guides a local LLM through analyzing a project's direct dependencies, identifying high-overhead packages, and designing low-risk, zero-dependency custom replacements.

1. Using cdxgen SBOM as the Authoritative Data Source

A CycloneDX SBOM generated by cdxgen (bom.json) provides a complete, normalized, and machine-readable inventory of all direct and transitive dependencies. Use it as your primary source of truth:

  1. Locate Direct Dependencies: Look under bom.metadata.component (the parent package) and trace its relationships in the dependencies array.
  2. Trace Dependency Trees: Find the dependencies block at the root of the SBOM. Each entry maps a package ref to its direct dependency dependsOn refs:
    json
    {
  "ref": "pkg:npm/foo@1.0.0",
  "dependsOn": ["pkg:npm/bar@2.0.0", "pkg:npm/baz@1.5.0"]
}
  3. Calculate Transitive Footprint: For any candidate direct dependency, traverse the dependsOn graph in the SBOM to identify how many total sub-packages will be completely purged from node_modules if that direct dependency is removed.
  4. Inspect Metadata: Filter out type: "development" components or dev-only scopes if you are optimizing production boot time and install footprint.

2. Advanced Analysis Data Points

Note 1: Utilizing Occurrence and Callstack Evidence

When cdxgen is run under --profile research (or during deep Evinse executions), it populates components with schema-valid occurrences and callstacks under evidence:

  • Occurrences: Check component.evidence.occurrences to find exactly which source files and line numbers import or reference the dependency.
  • Callstack: Check component.evidence.callstack to view the execution flows, depth of call paths, and entry points leading to the package.
  • LLM Action: Parse these arrays to immediately determine the depth and scope of usage without needing manual grep passes. If a package has only a single occurrence at a shallow depth, it is a prime candidate for pruning.
Note 2: Incorporating License, Author, and Publisher Data

Use the following additional SBOM metadata to guide the business and legal aspects of the replacement:

  • Licenses: Check the licenses array of the component. Replacing copyleft-licensed dependencies (e.g. GPL, LGPL) with a permissive custom implementation is a major compliance win.
  • Authors and Publishers: Check authors and publisher fields. Dependencies maintained by single authors or unknown publishers present higher supply chain risk (e.g., maintainer abandonment, malicious takeover) compared to standard built-ins or custom code.

3. Step-by-Step Analysis Workflow

Step 1: Mapping the Surface Area
  • Read the project's manifest (e.g. package.json, Cargo.toml, pyproject.toml) and gather the list of direct production dependencies.
  • Cross-reference this list with bom.json to verify their version and active presence in the dependency graph.
Show full SKILL.md (298 more words)Show less
Step 2: Code Search & Usage Audit
  • Use occurrences/callstack evidence (if present in the SBOM) or grep to scan the codebase for all references.
  • Note:
    • Which files import the package.
    • Which specific functions/methods are called.
    • If the usage is isolated to a single file, utility, or helper function.
Step 3: Assessing Replacement Viability

Evaluate candidates against these key replacement archetypes:

  • Native Replacements: The functionality is now natively supported by modern runtimes (e.g. replacing uuid with crypto.randomUUID(), got/axios with standard fetch, or yoctocolors/picocolors with standard ANSI sequences).
  • High-Overhead/Low-Usage Utilities: Packages imported to perform trivial tasks (e.g. properties-reader to get a single version string, or keyv to wrap a standard Map).
  • Complex/Risky Packages: Monolithic parser libraries (like TOML, YAML, HTML parsers, or JSON schema validators). These are High Risk to replace because custom parsers frequently miss edge cases or suffer from performance bugs.
Step 4: Drafting Custom Replacements

For viable candidates, design a zero-dependency JS/TS snippet. Follow these requirements:

  1. Compatibility: Ensure the new implementation supports the exact same input/output formats and signatures as the replaced library APIs.
  2. Standards: Avoid complex regexes that could cause backtracking vulnerabilities (e.g. ReDoS). Prefer simple string splitting, slice operations, and standard built-ins.
  3. Cross-Platform: Support Node.js, Bun, and Deno by using global/web-standard APIs (globalThis) where possible.

4. Risk Assessment Guide

Assign a risk category to each proposed replacement:

Risk CategoryCriteriaExample
Low RiskStandard built-in exists; utility does basic string formatting/math; isolated to a single non-critical utility.Replacing uuid with crypto.randomUUID() or yoctocolors with ANSI codes.
Medium RiskRequires writing custom parsing logic for standard formats; used in core execution paths; handles external network calls.Replacing cheerio with regex/slicing for HTML page scraping.
High RiskParser/validation logic for complex, specification-heavy formats; deeply integrated across numerous modules.Replacing yaml, @babel/parser, or ajv schema validator.

© cdxgen, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/bom-slimmer of cdxgen/cdxgen.

Open the folder on GitHubat commit e256966

Compare with similar skills

Bom Slimmer next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Bom Slimmer compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Bom Slimmer this skillcdxgen/cdxgen1.1k—~1.6kAutomated safety check: PassApache-2.0
Kesekit Checkcdppcorp/KESE-KIT361—~1.3kAutomated safety check: PassMIT
SbomNVIDIA/OpenShell16k—~1.3kAutomated safety check: PassApache-2.0
Sca TrivyAgentSecOps/SecOpsAgentKit2202 repos~3.7kAutomated safety check: PassCustom licence
Sbom SyftAgentSecOps/SecOpsAgentKit2201 repos~3.5kAutomated safety check: PassCustom licence
Managing Vulnerabilitiesancoleman/ai-design-components526—~3.8kAutomated safety check: PassMIT

Similar skills

  • Kesekit Check

    cdppcorp/KESE-KIT

    Run a pre-deployment security compliance checklist based on KISA guidelines.

    361 GitHub stars~1.3k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Sbom

    NVIDIA/OpenShell

    Official

    Generate and manage Software Bill of Materials (SBOMs) for the OpenShell project.

    16k GitHub stars~1.3k tokensUpdated today
    SecurityAuto-check passed

  • Sca Trivy

    AgentSecOps/SecOpsAgentKit

    Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license…

    220 GitHub starsUsed in 2 repos~3.7k tokens
    SecurityAuto-check passed

  • Sbom Syft

    AgentSecOps/SecOpsAgentKit

    Software Bill of Materials (SBOM) generation using Syft for container images, filesystems, and archives.

    220 GitHub starsUsed in 1 repo~3.5k tokens
    SecurityAuto-check passed

  • Managing Vulnerabilities

    ancoleman/ai-design-components

    Implementing multi-layer security scanning (container, SAST, DAST, SCA, secrets), SBOM generation, and risk-based vulnerability prioritization in CI/CD pipelines.

    526 GitHub stars~3.8k tokensUpdated 10 mo ago
    SecurityAuto-check passed

  • Atmos Sbom

    cloudposse/atmos

    Atmos SBOM provenance: CycloneDX and SPDX generation from vendor and Terraform evidence, coverage diagnostics, NTIA validation, and native CI workflow-artifact publication

    1.4k GitHub stars~1.4k tokensUpdated today
    SecurityAuto-check passed

More from cdxgen/cdxgen

All 17 skills in this repo

  • AI Bom

    cdxgen/cdxgen

    Generates AI-BOM, MCP inventory, AI skill inventory, and AI authorship provenance documents with cdxgen, cataloging models, inference services, Hugging Face purls, MCP servers and their…

    1.1k GitHub stars~2.5k tokensUpdated yesterday
    Auto-check passed

  • Bom Audit

    cdxgen/cdxgen

    Runs supply-chain risk analysis on CycloneDX BOMs with cdx-audit predictive auditing and cdxgen --bom-audit embedded rules, covering npm and PyPI package compromise posture, CI permission risk…

    1.1k GitHub stars~2.4k tokensUpdated yesterday
    Auto-check passed

  • Bom Evidence

    cdxgen/cdxgen

    Enriches an existing CycloneDX BOM with occurrence, callstack, reachability, data-flow, and crypto-flow evidence using cdxgen evinse, including Go analysis via Golem and Rust analysis via Rusi, and…

    1.1k GitHub stars~1.9k tokensUpdated yesterday
    Auto-check passed

  • Bom Explore

    cdxgen/cdxgen

    Explores and triages a CycloneDX BOM interactively with the cdxi REPL, using built-in commands for dependency trees, licenses, services, cryptographic assets, audit findings, evidence occurrences…

    1.1k GitHub stars~1.2k tokensUpdated yesterday
    Auto-check passed

  • Bom Signing

    cdxgen/cdxgen

    Signs and verifies CycloneDX BOMs using cdxgen's native JSON Signature Format (JSF) implementation via cdx-sign and cdx-verify, supporting granular component, service, and annotation signatures…

    1.1k GitHub stars~1.5k tokensUpdated yesterday
    Auto-check passed

  • Bom Convert Validate

    cdxgen/cdxgen

    Converts CycloneDX BOMs to SPDX 3.0.1 JSON-LD or between CycloneDX spec versions with cdx-convert, and validates BOMs against JSON schema, deep consistency checks, and OWASP SCVS and EU Cyber…

    1.1k GitHub stars~1.5k tokensUpdated yesterday
    Auto-check: warnings

Categories

Questions about Bom Slimmer

What does Bom Slimmer do?

Reviews a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using cdxgen SBOM evidence, occurrence/callstack usage data, and license and…. Bom Slimmer is an agent skill from cdxgen/cdxgen. Reviews a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using cdxgen SBOM evidence, occurrence/callstack usage data, and license and supply-chain risk evaluation.

When should I use Bom Slimmer?

Bom Slimmer fits situations like: asked to shrink nodemodules; reduce dependency bloat; copyleft exposure; replace utility packages with native.

How do I install Bom Slimmer in Claude Code?

Run `npx skills add cdxgen/cdxgen --skill bom-slimmer -a claude-code`. Or copy the skill folder (.agents/skills/bom-slimmer in cdxgen/cdxgen) into .claude/skills/bom-slimmer in your project. Claude Code loads it when a task matches its description.

How do I install Bom Slimmer in Codex?

Run `npx skills add cdxgen/cdxgen --skill bom-slimmer -a codex`. Or copy the skill folder (.agents/skills/bom-slimmer in cdxgen/cdxgen) into .agents/skills/bom-slimmer in your project. Codex loads it when a task matches its description.

Can I use Bom Slimmer in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cdxgen/cdxgen --skill bom-slimmer -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/bom-slimmer, .gemini/skills/bom-slimmer, .github/skills/bom-slimmer and .opencode/skills/bom-slimmer in your project.

What does Bom Slimmer need to run?

SKILL.md names no scripts, command-line tools or credentials: Bom Slimmer is instructions for the agent only. Our summary lists: Node.js.

Does Bom Slimmer access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Bom Slimmer safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Bom Slimmer use?

Bom Slimmer is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Bom Slimmer use?

About 1.6k tokens (SKILL.md is roughly 6.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Bom Slimmer?

Skills that share tags, products or a category with Bom Slimmer: Kesekit Check (cdppcorp/KESE-KIT, 361 stars), Sbom (NVIDIA/OpenShell, 16k stars), Sca Trivy (AgentSecOps/SecOpsAgentKit, 220 stars) and Sbom Syft (AgentSecOps/SecOpsAgentKit, 220 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Bom Slimmer?

cdxgen (a GitHub organization) maintains it in cdxgen/cdxgen, which has 1,085 GitHub stars. The repository holds 17 skills in this directory. The repository was last updated on October 8, 2026.

Source: cdxgen/cdxgen on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.