New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Atmos Sbom

by cloudposse in cloudposse/atmos

Atmos SBOM provenance: CycloneDX and SPDX generation from vendor and Terraform evidence, coverage diagnostics, NTIA validation, and native CI workflow-artifact publication

Apache-2.0Auto-check passedSecurity

Install Atmos Sbom

skills CLI
$ npx skills add cloudposse/atmos --skill atmos-sbom -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install cloudposse/atmos atmos-sbom --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/cloudposse/atmos.git skills-src && mkdir -p .claude/skills && cp -r skills-src/agent-skills/skills/atmos-sbom .claude/skills/atmos-sbom && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
atmos-sbom
GitHub stars
1.4k
Token cost
~1.4k tokens
SKILL.md length
534 words
Files
1
Skills in repo
70
Repo updated
First seen
Licence
Apache-2.0

At a glance

Atmos SBOM provenance: CycloneDX and SPDX generation from vendor and Terraform evidence, coverage diagnostics, NTIA validation, and native CI workflow-artifact publication

  • Tasks that involve Supply chain security
  • SKILL.md covers Purpose, Related Skills, Generate an SBOM and Provenance and NTIA Modes, plus 2 more sections
  • Calls git; needs GITHUB_TOKEN
  • Tasks that involve Infrastructure as code

What it does

Atmos Sbom is an agent skill from cloudposse/atmos. Atmos SBOM provenance: CycloneDX and SPDX generation from vendor and Terraform evidence, coverage diagnostics, NTIA validation, and native CI workflow-artifact publication

Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Supply chain security, Infrastructure as code and Regulatory compliance. It works with Terraform. The repository describes itself as: Atmos is the open-source runtime for infrastructure — it builds, authenticates, and ships Terraform, OpenTofu, Packer, Ansible, Kubernetes, Helm, and containers the same way on… The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Supply chain security
  • Tasks that involve Infrastructure as code
  • Tasks that involve Regulatory compliance

Example prompts

  • “Use the atmos-sbom skill to atmo SBOM provenance: CycloneDX and SPDX generation from vendor and Terraform evidence, coverage diagnostics, NTIA…”
  • “/atmos-sbom”

Requirements

  • A credential in GITHUB_TOKEN

What it can do on your machine

Read from SKILL.md and the folder at commit fbae93f. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • git

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • GITHUB_TOKEN

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Atmos Sbom loads about 1.4k tokens when it runs. Until then it costs about 46 tokens; SKILL.md has 534 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~46
When it runs · the whole SKILL.md, loaded when a task matches
~1.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from cloudposse/atmos at commit fbae93f, republished under its Apache-2.0 licence (© cloudposse). 534 words, ~1,373 tokens.

Download SKILL.mdSave it as .claude/skills/atmos-sbom/SKILL.md (or your agent's skills folder).
name
atmos-sbom
description
Atmos SBOM provenance: CycloneDX and SPDX generation from vendor and Terraform evidence, coverage diagnostics, NTIA validation, and native CI workflow-artifact publication
metadata.copyright
Copyright Cloud Posse, LLC 2026
metadata.version
1.0.0
metadata.category
state-versioning
references
../atmos-ci/references/native-ci.md, ../atmos-vendoring/references/component-updater.md

Atmos SBOM Provenance

Purpose

Use this skill to generate, review, or publish an Atmos software bill of materials (SBOM). Atmos produces a provenance/build-input SBOM: it records evidence used to build or run the selected infrastructure scope. It is not a claim that every deployed workload has been inventoried.

Atmos-managed source receipts (vendor.lock.yaml, including OCI-sourced artifacts) are always included, regardless of --scope. --scope additionally selects one of two adapter groups: the default terraform adds Terraform provider locks and Terraform modules (when the configured command exposes a stable module graph); --scope dependencies instead adds Atmos's own toolchain (.tools/toolchain.lock.yaml) and version-track (versions.lock.yaml) evidence. Helm, Helmfile, discovered deployed images, image package contents, and OpenTofu module graphs are outside this initial scope and must be reported as incomplete or unavailable rather than silently treated as absent.

NeedLoad
Immutable vendor receipts, reconciliation, Component Updater PRsatmos-vendoring
Just-in-time component source workdirs and source receiptsatmos-components
Native CI workflow structure and GitHub Actions runtime setupatmos-ci
Toolchain locks and configured Terraform/OpenTofu commandsatmos-toolchain
Version-track locksatmos-version

Generate an SBOM

Generate CycloneDX JSON to stdout, or write either supported format to a reviewed output file:

shell
atmos sbom generate --format cyclonedx-json
atmos sbom generate --format spdx-json --output sbom.spdx.json
atmos sbom generate --include-files --output sbom.cyclonedx.json

--include-files expands the output with the vendor receipt's installation-file relationships; omit it for the normal artifact-oriented output.

The result is derived from evidence, not guesses:

  • vendor.lock.yaml records immutable Git commits, OCI manifest digests, or verified content hashes and the installed-file inventory for vendor.yaml, component.yaml, and mixin installs.
  • Just-in-time component workdirs contribute local immutable-resolution receipts; they do not create a committed vendor lock.
  • .terraform.lock.hcl is authoritative for the selected provider versions and checksums.
  • Atmos invokes the configured Terraform command (or terraform when none is configured) as modules -json; this requires Terraform 1.10+ and an initialized component directory.

Never insert a checksum, purl, supplier, source URL, or module inventory by inference. Missing evidence must remain NOASSERTION or appear as an explicit coverage diagnostic.

Show full SKILL.md (224 more words)Show less

Provenance and NTIA Modes

The default is --mode provenance, which renders available evidence with coverage diagnostics:

shell
atmos sbom generate --scope terraform --mode provenance --format cyclonedx-json

Use --mode ntia only when a declared subject is available and every adapter required for the selected Terraform scope reports complete coverage:

shell
atmos sbom generate \
  --scope terraform \
  --mode ntia \
  --subject-name infra-live \
  --subject-version "$(git rev-parse --short HEAD)" \
  --subject-supplier "Cloud Posse, LLC" \
  --format spdx-json \
  --output infra-live.sbom.spdx.json

NTIA mode must fail—not downgrade silently—when the subject is incomplete, a provider lock lacks the required SHA-256 evidence, a module is not immutably resolved, or the module graph command is unavailable. A configured OpenTofu command is honored, but its module inventory is unavailable unless it implements the same stable JSON interface.

Native CI Publication

--upload publishes the already-generated document through the detected native CI provider. The document remains the source of truth and is still written to stdout or --output.

In GitHub Actions, publication stores a workflow artifact via the Actions runtime API. Add the runtime action before the Atmos command:

yaml
permissions:
  contents: read

steps:
  - uses: actions/checkout@v6
  - uses: cloudposse/atmos/actions/github-runtime@v1
    with:
      mode: env
  - run: atmos sbom generate --format spdx-json --output sbom.spdx.json --upload
    env:
      GITHUB_TOKEN: ${{ github.token }}

Do not claim that this uploads dependencies to GitHub Dependency Graph. GitHub's SBOM APIs can export or request GitHub-generated reports, but do not accept arbitrary submitted SBOMs. The correct result is a retained, auditable workflow artifact.

Safe Output Rules

  • SBOM output must not contain absolute filesystem paths, credentials, tokens, or signed URLs.
  • Source references are credential-free and use immutable resolved evidence where available.
  • File-level data is opt-in through --include-files.
  • Preserve coverage diagnostics in the output; a missing domain is a finding, not a zero-dependency result.

© cloudposse, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in agent-skills/skills/atmos-sbom of cloudposse/atmos.

Open the folder on GitHubat commit fbae93f

Compare with similar skills

Atmos Sbom next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Atmos Sbom compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Atmos Sbom this skillcloudposse/atmos1.4k—~1.4kAutomated safety check: PassApache-2.0
Sca TrivyAgentSecOps/SecOpsAgentKit2202 repos~3.7kAutomated safety check: PassCustom licence
Create Policyharness/harness-skills115—~1.9kAutomated safety check: PassApache-2.0
Azure Firmware AnalysisMicrosoftDocs/Agent-Skills777—~1.2kAutomated safety check: PassCC-BY-4.0
Managing Vulnerabilitiesancoleman/ai-design-components526—~3.8kAutomated safety check: PassMIT
Terraform Security Auditc0x12c/ai-toolkit106—~2kAutomated safety check: PassNone

Similar skills

  • Sca Trivy

    AgentSecOps/SecOpsAgentKit

    Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license…

    220 GitHub starsUsed in 2 repos~3.7k tokens
    SecurityAuto-check passed

  • Create Policy

    harness/harness-skills

    Create OPA governance policies for Harness via MCP. An agent skill from harness/harness-skills.

    115 GitHub stars~1.9k tokensUpdated 2 days ago
    DevOps & CloudAuto-check passed

  • Azure Firmware Analysis

    MicrosoftDocs/Agent-Skills

    Official

    Expert knowledge for Azure Firmware Analysis development including best practices, security, integrations & coding patterns, and deployment.

    777 GitHub stars~1.2k tokensUpdated 3 days ago
    DevOps & CloudAuto-check passed

  • Managing Vulnerabilities

    ancoleman/ai-design-components

    Implementing multi-layer security scanning (container, SAST, DAST, SCA, secrets), SBOM generation, and risk-based vulnerability prioritization in CI/CD pipelines.

    526 GitHub stars~3.8k tokensUpdated 10 mo ago
    SecurityAuto-check passed

  • Terraform Security Audit

    c0x12c/ai-toolkit

    Security audit for Terraform codebases covering IAM, networking, encryption, secrets, access control, and compliance.

    106 GitHub stars~2k tokensUpdated 3 mo ago
    SecurityAuto-check passed

  • AWS Cloud Advisor

    tech-leads-club/agent-skills

    Answers AWS architecture, security and service-selection questions by searching AWS documentation through MCP tools first, then adapting advice to your stack and team.

    7k GitHub stars~2.1k tokensUpdated today
    DevOps & CloudAuto-check passed

More from cloudposse/atmos

All 70 skills in this repo

  • Fix Log

    cloudposse/atmos

    A skill your agent uses when implementing, finishing, documenting, or reviewing a fix, repair, remediation, bug fix, debug-and-fix task, workflow fix, infrastructure fix, or any change that should…

    1.4k GitHub stars~685 tokensUpdated today
    Auto-check passed

  • Atmos Lint

    cloudposse/atmos

    Atmos Terraform linting with TFLint: standalone atmos terraform lint, component-aware config discovery and toolchain versions, TFLint rule configuration, and lifecycle hooks/CI findings.

    1.4k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Changelog

    cloudposse/atmos

    Blog post authoring for Atmos: MDX template, frontmatter, website/blog/tags.yml and authors.yml rules, problem-first framing, backtick-opening ban, optional cast embeds, and no-Go-internals leakage.

    1.4k GitHub stars~2.7k tokensUpdated today
    Auto-check passed

  • Editions

    cloudposse/atmos

    Decide whether a PR's new or changed default needs edition-journal handling (pkg/edition, docs/prd/editions.md), and do the mechanical work if so: journal entries, the four-layer default check…

    1.4k GitHub stars~2.1k tokensUpdated today
    Auto-check passed

  • Atmos Migration

    cloudposse/atmos

    Migrate to Atmos from native Terraform, Terraform Workspaces, Terramate, Terragrunt, Make, Just, or Task; migrate tool versions from mise or Aqua CLI; migrate AWS/GCP/Azure CLI configs, Leapp…

    1.4k GitHub stars~5.1k tokensUpdated today
    Auto-check: warnings

  • PR Maintenance Loop

    cloudposse/atmos

    Start an hourly background loop that keeps the current branch's PR rebased, its addressed CodeRabbit threads resolved, its CI checks passing, its lint clean, its tests passing with adequate patch…

    1.4k GitHub stars~1.4k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Atmos Sbom

What does Atmos Sbom do?

Atmos SBOM provenance: CycloneDX and SPDX generation from vendor and Terraform evidence, coverage diagnostics, NTIA validation, and native CI workflow-artifact publication. Atmos Sbom is an agent skill from cloudposse/atmos.

When should I use Atmos Sbom?

Atmos Sbom fits situations like: tasks that involve Supply chain security; tasks that involve Infrastructure as code; tasks that involve Regulatory compliance.

How do I install Atmos Sbom in Claude Code?

Run `npx skills add cloudposse/atmos --skill atmos-sbom -a claude-code`. Or copy the skill folder (agent-skills/skills/atmos-sbom in cloudposse/atmos) into .claude/skills/atmos-sbom in your project. Claude Code loads it when a task matches its description.

How do I install Atmos Sbom in Codex?

Run `npx skills add cloudposse/atmos --skill atmos-sbom -a codex`. Or copy the skill folder (agent-skills/skills/atmos-sbom in cloudposse/atmos) into .agents/skills/atmos-sbom in your project. Codex loads it when a task matches its description.

Can I use Atmos Sbom in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cloudposse/atmos --skill atmos-sbom -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/atmos-sbom, .gemini/skills/atmos-sbom, .github/skills/atmos-sbom and .opencode/skills/atmos-sbom in your project.

What does Atmos Sbom need to run?

Going by SKILL.md and its folder, Atmos Sbom needs the command-line tools its instructions call (git) and credentials named GITHUB_TOKEN. Our summary lists: A credential in GITHUB_TOKEN.

Does Atmos Sbom access the network?

SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Atmos Sbom safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Atmos Sbom use?

Atmos Sbom is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Atmos Sbom use?

About 1.4k tokens (SKILL.md is roughly 5.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Atmos Sbom?

Skills that share tags, products or a category with Atmos Sbom: Sca Trivy (AgentSecOps/SecOpsAgentKit, 220 stars), Create Policy (harness/harness-skills, 115 stars), Azure Firmware Analysis (MicrosoftDocs/Agent-Skills, 777 stars) and Managing Vulnerabilities (ancoleman/ai-design-components, 526 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Atmos Sbom?

cloudposse (a GitHub organization) maintains it in cloudposse/atmos, which has 1,398 GitHub stars. The repository holds 70 skills in this directory. The repository was last updated on October 9, 2026.

Source: cloudposse/atmos on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.