---
name: "syft-sbom-generation-pipeline"
description: "Generate comprehensive Software Bill of Materials (SBOM) for containers and filesystems."
metadata:
  author: "Anchore"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "generate sbom with syft"
  - "export cyclonedx sbom syft"
  - "catalog container packages syft"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Syft Software Bill of Materials (SBOM) Generation

Builds SBOMs using Anchore Syft: cataloging packages across 20+ package managers, detecting operating system packages (Alpine, Debian, RPM), and exporting in SPDX and CycloneDX formats.

## When to Invoke
Invoke this skill whenever you need to:
- generate sbom with syft
- export cyclonedx sbom syft
- catalog container packages syft

## Execution SOP & Rules
1. Run syft <image_uri> -o cyclonedx-json=sbom.json to generate standardized SBOMs.
2. Audit the generated SBOM to verify all top-level and transitive dependencies are listed.
3. Upload SBOM JSON files as build artifacts in continuous integration pipelines.
4. Feed the generated SBOM directly into Grype for rapid vulnerability matching.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.