Official agent skill

Sbom

Generate and manage Software Bill of Materials (SBOMs) for the OpenShell project.

OfficialApache-2.0Auto-check passedSecurity

Install Sbom

skills CLI

$ npx skills add NVIDIA/OpenShell --skill sbom -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install NVIDIA/OpenShell sbom --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/NVIDIA/OpenShell.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/sbom .claude/skills/sbom && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "sbom" agent skill from https://github.com/NVIDIA/OpenShell/tree/main/.agents/skills/sbom into .claude/skills/sbom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sbom", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/NVIDIA/OpenShell/tree/main/.agents/skills/sbom

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add NVIDIA/OpenShell --skill sbom -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install NVIDIA/OpenShell sbom --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/NVIDIA/OpenShell.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/sbom .agents/skills/sbom && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "sbom" agent skill from https://github.com/NVIDIA/OpenShell/tree/main/.agents/skills/sbom into .agents/skills/sbom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sbom", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add NVIDIA/OpenShell --skill sbom -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install NVIDIA/OpenShell sbom --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/NVIDIA/OpenShell.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/sbom .cursor/skills/sbom && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "sbom" agent skill from https://github.com/NVIDIA/OpenShell/tree/main/.agents/skills/sbom into .cursor/skills/sbom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sbom", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/NVIDIA/OpenShell.git --path .agents/skills/sbom

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add NVIDIA/OpenShell --skill sbom -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install NVIDIA/OpenShell sbom --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/NVIDIA/OpenShell.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/sbom .gemini/skills/sbom && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "sbom" agent skill from https://github.com/NVIDIA/OpenShell/tree/main/.agents/skills/sbom into .gemini/skills/sbom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sbom", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install NVIDIA/OpenShell sbom

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add NVIDIA/OpenShell --skill sbom -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/NVIDIA/OpenShell.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/sbom .github/skills/sbom && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "sbom" agent skill from https://github.com/NVIDIA/OpenShell/tree/main/.agents/skills/sbom into .github/skills/sbom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sbom", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add NVIDIA/OpenShell --skill sbom -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install NVIDIA/OpenShell sbom --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/NVIDIA/OpenShell.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/sbom .opencode/skills/sbom && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "sbom" agent skill from https://github.com/NVIDIA/OpenShell/tree/main/.agents/skills/sbom into .opencode/skills/sbom/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sbom", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: sbom
GitHub stars: 15k
Token cost: ~1.3k tokens
SKILL.md length: 481 words
Files: 1
Skills in repo: 23
Repo updated: Oct 8, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Generate and manage Software Bill of Materials (SBOMs) for the OpenShell project.

Works in 3 steps: Generate (sbom:generate): Syft scans the… → Resolve (sbom:resolve): Public registry… → CSV (sbom:csv): JSON SBOMs are converted…
Keywords - SBOM
SKILL.md covers Overview, Prerequisites, Inspecting an Image SBOM and Inspecting an Auditable Image…, plus 8 more sections
Calls mise, uv and docker

What it does

Sbom is an agent skill from NVIDIA/OpenShell, published by the product's own GitHub organization. Generate and manage Software Bill of Materials (SBOMs) for the OpenShell project. Covers SBOM generation with Syft, license resolution via public registries, and CSV export for compliance review. Trigger keywords - SBOM, sbom, bill of materials, license audit, license resolution, generate sbom, sbom csv, dependency license, supply chain, license scan.

Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Supply chain security and Regulatory compliance. The repository describes itself as: OpenShell is the safe, private runtime for autonomous AI agents. The licence is Apache-2.0.

When your agent uses it

Keywords - SBOM
Bill of materials
License resolution
Dependency license

Example prompts

“/sbom”

Requirements

Python 3
Docker

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

Generate (sbom:generate): Syft scans the workspace source tree and produces a CycloneDX JSON SBOM
Resolve (sbom:resolve): Public registry APIs fill in missing or hash-based licenses in the JSON
CSV (sbom:csv): JSON SBOMs are converted to CSV for review

What it can do on your machine

Read from SKILL.md and the folder at commit 277f922. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- mise
- uv
- docker
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use uv and docker, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Sbom loads about 1.3k tokens when it runs. Until then it costs about 90 tokens; SKILL.md has 481 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~90
When it runs · the whole SKILL.md, loaded when a task matches: ~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from NVIDIA/OpenShell at commit 277f922, republished under its Apache-2.0 licence (© NVIDIA). 481 words, ~1,316 tokens.

Download SKILL.mdSave it as .claude/skills/sbom/SKILL.md (or your agent's skills folder).

name: sbom
description: Generate and manage Software Bill of Materials (SBOMs) for the OpenShell project. Covers SBOM generation with Syft, license resolution via public registries, and CSV export for compliance review. Trigger keywords - SBOM, sbom, bill of materials, license audit, license resolution, generate sbom, sbom csv, dependency license, supply chain, license scan.
metadata.internal: true

SBOM Generation and License Resolution

Generate CycloneDX SBOMs, resolve missing licenses, and export to CSV for compliance review.

Overview

The OpenShell SBOM tooling produces source-tree CycloneDX JSON SBOMs using Syft, resolves missing or hash-based licenses by querying public registries (crates.io, npm, PyPI), and exports the results to CSV for stakeholder review.

SBOMs are release artifacts only -- they are generated on demand and not committed to the repository. Output lands in deploy/sbom/output/ (gitignored).

Pushed gateway, sandbox, and supervisor images carry an SPDX SBOM and minimal SLSA provenance as OCI attestations. Branch E2E, Release Dev, and Release Tag image binaries embed cargo-auditable metadata, so their image SBOMs include linked Rust crates.

Prerequisites

mise install has been run (installs Syft and other tools)
The repository is checked out at the root

Inspecting an Image SBOM

BuildKit uses its default Syft scanner and attaches one SPDX document per platform. Read one without pulling the image:

bash

docker buildx imagetools inspect ghcr.io/nvidia/openshell/gateway:latest \
  --format '{{ json (index .SBOM "linux/amd64").SPDX }}'

Validate the final attestation, requiring a Cargo package for an auditable image:

bash

tasks/scripts/verify-image-sbom.sh ghcr.io/nvidia/openshell/gateway:latest --require-cargo

Inspecting an Auditable Image Binary

Opt into auditable metadata when staging a local image binary:

bash

OPENSHELL_AUDITABLE=1 PREBUILT_ARCH=amd64 \
  tasks/scripts/stage-prebuilt-binaries.sh gateway

Scan the staged binary rather than the source tree:

bash

mise x -- syft \
  "file:deploy/docker/.build/prebuilt-binaries/amd64/openshell-gateway" \
  -o cyclonedx-json

This output is limited to packages Syft discovers from that binary. Use mise run sbom for the broader source-tree license-compliance inventory.

Workflow 1: Full SBOM Generation (One Command)

bash

mise run sbom

This single command chains three stages:

Generate (sbom:generate): Syft scans the workspace source tree and produces a CycloneDX JSON SBOM
Resolve (sbom:resolve): Public registry APIs fill in missing or hash-based licenses in the JSON
CSV (sbom:csv): JSON SBOMs are converted to CSV for review

Output directory: deploy/sbom/output/

After running, the user can find:

deploy/sbom/output/*.cdx.json -- full CycloneDX SBOMs
deploy/sbom/output/*.csv -- CSV exports ready for spreadsheet review

Workflow 2: Individual Stages

Run stages independently when debugging or iterating:

bash

mise run sbom:generate   # Generate JSON SBOMs only (requires Syft)
mise run sbom:resolve    # Resolve licenses in existing JSONs (queries APIs)
mise run sbom:csv        # Convert existing JSONs to CSV

Show full SKILL.md (188 more words)Show less

Workflow 3: License Check (CI Advisory)

bash

mise run sbom:check

Reports unresolved licenses without failing. Intended for PR CI as a non-blocking advisory check. Requires that SBOMs have already been generated (mise run sbom:generate).

Workflow 4: Processing External SBOMs

The Python scripts accept explicit file paths, so they can process SBOMs from any source (e.g., NVIDIA nSpect pipeline output):

bash

uv run python deploy/sbom/resolve_licenses.py /path/to/external-sbom.json
uv run python deploy/sbom/sbom_to_csv.py /path/to/external-sbom.json

License Resolution Details

The resolver queries these public registries:

Registry	Package URL prefix	Method
crates.io	`pkg:cargo/*`	REST API
npm	`pkg:npm/*`	Registry API
PyPI	`pkg:pypi/*`	JSON API
Go modules	`pkg:golang/*`	Known license map (no API)
Debian/Ubuntu	`pkg:deb/*`	Known license map

Components from private registries (e.g., @openclaw/* npm packages) are not resolved and will appear in the "unresolved" report.

Output Files

Pattern	Description
`deploy/sbom/output/openshell-source-{version}.cdx.json`	CycloneDX JSON SBOM
`deploy/sbom/output/openshell-source-{version}.csv`	CSV export (name, version, type, purl, licenses, bom-ref)

Key Files

File	Purpose
`deploy/sbom/resolve_licenses.py`	License resolution script
`deploy/sbom/sbom_to_csv.py`	JSON-to-CSV converter
`tasks/sbom.toml`	Mise task definitions
`mise.toml`	Syft tool definition (under `[tools]`)

Quick Reference

Task	Command
Full pipeline	`mise run sbom`
Generate only	`mise run sbom:generate`
Resolve licenses	`mise run sbom:resolve`
Export CSV	`mise run sbom:csv`
CI license check	`mise run sbom:check`
Process external SBOM	`uv run python deploy/sbom/resolve_licenses.py <file>`

Files

Just SKILL.md in .agents/skills/sbom of NVIDIA/OpenShell.

Open the folder on GitHubat commit 277f922

Compare with similar skills

Sbom next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Sbom compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Sbom this skillNVIDIA/OpenShell	15k	—	~1.3k	Automated safety check: Pass	Apache-2.0	today
Kesekit Checkcdppcorp/KESE-KIT	361	—	~1.3k	Automated safety check: Pass	MIT	6 mo ago
Bom Slimmercdxgen/cdxgen	1.1k	—	~1.6k	Automated safety check: Pass	Apache-2.0	today
Sca TrivyAgentSecOps/SecOpsAgentKit	220	2 repos	~3.7k	Automated safety check: Pass	Custom licence	5 mo ago
Sbom SyftAgentSecOps/SecOpsAgentKit	220	1 repos	~3.5k	Automated safety check: Pass	Custom licence	5 mo ago
Managing Vulnerabilitiesancoleman/ai-design-components	526	—	~3.8k	Automated safety check: Pass	MIT	10 mo ago

Similar skills

Kesekit Check
cdppcorp/KESE-KIT
Run a pre-deployment security compliance checklist based on KISA guidelines.
361 GitHub stars~1.3k tokensUpdated 6 mo ago
SecurityAuto-check passed
Bom Slimmer
cdxgen/cdxgen
Reviews a codebase's direct dependencies and designs lightweight, low-risk, zero-dependency custom replacements using cdxgen SBOM evidence, occurrence/callstack usage data, and license and…
1.1k GitHub stars~1.6k tokensUpdated today
SecurityAuto-check passed
Sca Trivy
AgentSecOps/SecOpsAgentKit
Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license…
220 GitHub starsUsed in 2 repos~3.7k tokens
SecurityAuto-check passed
Sbom Syft
AgentSecOps/SecOpsAgentKit
Software Bill of Materials (SBOM) generation using Syft for container images, filesystems, and archives.
220 GitHub starsUsed in 1 repo~3.5k tokens
SecurityAuto-check passed
Managing Vulnerabilities
ancoleman/ai-design-components
Implementing multi-layer security scanning (container, SAST, DAST, SCA, secrets), SBOM generation, and risk-based vulnerability prioritization in CI/CD pipelines.
526 GitHub stars~3.8k tokensUpdated 10 mo ago
SecurityAuto-check passed
Atmos Sbom
cloudposse/atmos
Atmos SBOM provenance: CycloneDX and SPDX generation from vendor and Terraform evidence, coverage diagnostics, NTIA validation, and native CI workflow-artifact publication
1.4k GitHub stars~1.4k tokensUpdated today
SecurityAuto-check passed

Questions about Sbom

What does Sbom do?

Generate and manage Software Bill of Materials (SBOMs) for the OpenShell project. Sbom is an agent skill from NVIDIA/OpenShell, published by the product's own GitHub organization. Generate and manage Software Bill of Materials (SBOMs) for the OpenShell project.

When should I use Sbom?

Sbom fits situations like: keywords - SBOM; bill of materials; license resolution; dependency license.

How do I install Sbom in Claude Code?

Run `npx skills add NVIDIA/OpenShell --skill sbom -a claude-code`. Or copy the skill folder (.agents/skills/sbom in NVIDIA/OpenShell) into .claude/skills/sbom in your project. Claude Code loads it when a task matches its description.

How do I install Sbom in Codex?

Run `npx skills add NVIDIA/OpenShell --skill sbom -a codex`. Or copy the skill folder (.agents/skills/sbom in NVIDIA/OpenShell) into .agents/skills/sbom in your project. Codex loads it when a task matches its description.

Can I use Sbom in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add NVIDIA/OpenShell --skill sbom -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sbom, .gemini/skills/sbom, .github/skills/sbom and .opencode/skills/sbom in your project.

What does Sbom need to run?

Going by SKILL.md and its folder, Sbom needs the command-line tools its instructions call (mise, uv and docker). Our summary lists: Python 3; Docker.

Does Sbom access the network?

SKILL.md contains no URLs. Its commands use uv and docker, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Sbom safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Sbom use?

Sbom is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Sbom use?

About 1.3k tokens (SKILL.md is roughly 5.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Sbom?

Skills that share tags, products or a category with Sbom: Kesekit Check (cdppcorp/KESE-KIT, 361 stars), Bom Slimmer (cdxgen/cdxgen, 1.1k stars), Sca Trivy (AgentSecOps/SecOpsAgentKit, 220 stars) and Sbom Syft (AgentSecOps/SecOpsAgentKit, 220 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Sbom?

NVIDIA (a GitHub organization, an official publisher) maintains it in NVIDIA/OpenShell, which has 15,338 GitHub stars. The repository holds 23 skills in this directory. The repository was last updated on October 8, 2026.

Source: NVIDIA/OpenShell on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Sbom

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

SBOM Generation and License Resolution

Overview

Prerequisites

Inspecting an Image SBOM

Inspecting an Auditable Image Binary

Workflow 1: Full SBOM Generation (One Command)

Workflow 2: Individual Stages

Workflow 3: License Check (CI Advisory)

Workflow 4: Processing External SBOMs

License Resolution Details

Output Files

Key Files

Quick Reference

Files

Compare with similar skills

Similar skills

More from NVIDIA/OpenShell

Related

Questions about Sbom