[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESRCD54PCMZ0CMDHMDW2B3":3,"skill-same:01M6ESRCD54PCMZ0CMDHMDW2B3":140},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":89,"commitSha":90,"skillDirectory":91,"forksCount":14,"repositoryHtmlUrl":92,"repositoryHomepageUrl":93,"ownerHtmlUrl":94,"ownerBlogUrl":6,"ownerDescription":95,"updatedAt":96,"install":97,"resources":110},"01M6ESRCD54PCMZ0CMDHMDW2B3","analyzing-sbom-for-supply-chain-vulnerabilities",null,"Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX\u002FSPDX parsing, or CVE correlation.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-sbom-for-supply-chain-vulnerabilities\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"vulnerabilities","chain","supply chain","analyzing sbom for supply chain vulnerabilities","SBOM","analyzing","database","assessment","t1195","analysis","vulnerability","api","Composition","aml","scanning","security assessment","reports","components","map","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-sbom-for-supply-chain-vulnerabilities\ndescription: 'Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON\n  formats to identify supply chain vulnerabilities by correlating components against\n  the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk\n  scores, identifies transitive vulnerability paths, and generates compliance reports.\n  Activates for requests involving SBOM analysis, software composition analysis, supply\n  chain security assessment, dependency vulnerability scanning, CycloneDX\u002FSPDX parsing,\n  or CVE correlation.\n\n  '\ndomain: cybersecurity\nsubdomain: supply-chain-security\ntags:\n- SBOM\n- CycloneDX\n- SPDX\n- NVD\n- CVE\n- supply-chain\n- dependency-analysis\n- syft\n- grype\nversion: 1.0.0\nauthor: mukul975\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0010\n- AML.T0104\nnist_ai_rmf:\n- GOVERN-5.2\n- MAP-1.6\n- MANAGE-2.2\n- GOVERN-1.1\n- GOVERN-4.2\nnist_csf:\n- GV.SC-01\n- GV.SC-03\n- GV.SC-06\n- GV.SC-07\nmitre_attack:\n- T1195.001\n- T1195.002\n- T1554\n- T1190\n---\n\n# Analyzing SBOM for Supply Chain Vulnerabilities\n\n## When to Use\n\n- A new regulatory requirement (EO 14028, EU CRA) mandates SBOM analysis for software deliveries\n- Security team needs to assess third-party risk by scanning vendor-provided SBOMs\n- CI\u002FCD pipeline requires automated vulnerability checks against generated SBOMs\n- Incident response needs to determine if a newly disclosed CVE affects deployed software\n- Procurement team requires supply chain risk assessment for a software acquisition\n\n**Do not use** for runtime vulnerability scanning of live systems; use container scanning tools (Trivy, Grype CLI) or host-based vulnerability scanners (Nessus, Qualys) instead.\n\n## Prerequisites\n\n- SBOM file in CycloneDX JSON (v1.4+) or SPDX JSON (v2.3+) format\n- Python 3.9+ with requests, networkx, and packaging libraries installed\n- NVD API key (free, from https:\u002F\u002Fnvd.nist.gov\u002Fdevelopers\u002Frequest-an-api-key) for higher rate limits\n- Network access to NVD API (https:\u002F\u002Fservices.nvd.nist.gov\u002Frest\u002Fjson\u002Fcves\u002F2.0)\n- Optionally: syft for SBOM generation, grype for cross-validation\n\n## Workflow\n\n### Step 1: Generate SBOM (if not provided)\n\nUse syft to create an SBOM from a container image or project directory:\n\n```bash\n# Generate CycloneDX JSON from a container image\nsyft alpine:latest -o cyclonedx-json > sbom-cyclonedx.json\n\n# Generate SPDX JSON from a project directory\nsyft dir:\u002Fpath\u002Fto\u002Fproject -o spdx-json > sbom-spdx.json\n\n# Generate from a running container\nsyft docker:my-app-container -o cyclonedx-json > sbom.json\n```\n\nSyft supports over 30 package ecosystems including npm, PyPI, Maven, Go modules, apt, apk, and RPM. The generated SBOM includes package names, versions, licenses, CPE identifiers, and PURL (Package URL) references.\n\n### Step 2: Parse SBOM and Extract Components\n\nParse the SBOM to extract all software components with their identifiers:\n\n**CycloneDX JSON Structure:**\n```json\n{\n  \"bomFormat\": \"CycloneDX\",\n  \"specVersion\": \"1.5\",\n  \"components\": [\n    {\n      \"type\": \"library\",\n      \"name\": \"lodash\",\n      \"version\": \"4.17.20\",\n      \"purl\": \"pkg:npm\u002Flodash@4.17.20\",\n      \"cpe\": \"cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:*:*:*\",\n      \"licenses\": [{\"license\": {\"id\": \"MIT\"}}]\n    }\n  ],\n  \"dependencies\": [\n    {\"ref\": \"pkg:npm\u002Fexpress@4.18.2\", \"dependsOn\": [\"pkg:npm\u002Flodash@4.17.20\"]}\n  ]\n}\n```\n\n**SPDX JSON Structure:**\n```json\n{\n  \"spdxVersion\": \"SPDX-2.3\",\n  \"packages\": [\n    {\n      \"name\": \"lodash\",\n      \"versionInfo\": \"4.17.20\",\n      \"externalRefs\": [\n        {\"referenceType\": \"purl\", \"referenceLocator\": \"pkg:npm\u002Flodash@4.17.20\"},\n        {\"referenceType\": \"cpe23Type\", \"referenceLocator\": \"cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:*:*:*\"}\n      ],\n      \"licenseConcluded\": \"MIT\"\n    }\n  ],\n  \"relationships\": [\n    {\"spdxElementId\": \"SPDXRef-express\", \"relatedSpdxElement\": \"SPDXRef-lodash\",\n     \"relationshipType\": \"DEPENDS_ON\"}\n  ]\n}\n```\n\n### Step 3: Correlate Components with NVD CVE Database\n\nQuery the NVD 2.0 API to find known vulnerabilities for each component:\n\n```python\nimport requests\n\nNVD_API = \"https:\u002F\u002Fservices.nvd.nist.gov\u002Frest\u002Fjson\u002Fcves\u002F2.0\"\n\ndef search_cves_by_cpe(cpe_name, api_key=None):\n    params = {\"cpeName\": cpe_name, \"resultsPerPage\": 50}\n    headers = {\"apiKey\": api_key} if api_key else {}\n    resp = requests.get(NVD_API, params=params, headers=headers, timeout=30)\n    resp.raise_for_status()\n    return resp.json().get(\"vulnerabilities\", [])\n\ndef search_cves_by_keyword(keyword, version=None, api_key=None):\n    params = {\"keywordSearch\": keyword, \"resultsPerPage\": 50}\n    headers = {\"apiKey\": api_key} if api_key else {}\n    resp = requests.get(NVD_API, params=params, headers=headers, timeout=30)\n    resp.raise_for_status()\n    return resp.json().get(\"vulnerabilities\", [])\n```\n\nThe NVD API supports searching by CPE name (most precise), keyword, CVE ID, and date ranges. Rate limits: 5 requests\u002F30 seconds without API key, 50 requests\u002F30 seconds with key.\n\n### Step 4: Build Dependency Graph and Identify Transitive Risks\n\nConstruct a directed graph of dependencies to trace vulnerability propagation:\n\n```python\nimport networkx as nx\n\ndef build_dependency_graph(sbom):\n    G = nx.DiGraph()\n    # Add nodes for each component\n    for comp in sbom[\"components\"]:\n        G.add_node(comp[\"purl\"], name=comp[\"name\"], version=comp[\"version\"])\n    # Add edges from dependency relationships\n    for dep in sbom.get(\"dependencies\", []):\n        for child in dep.get(\"dependsOn\", []):\n            G.add_edge(dep[\"ref\"], child)\n    return G\n```\n\nTransitive dependency analysis identifies components that are not directly included but are pulled in through dependency chains. A vulnerability in a deeply nested transitive dependency (e.g., 4 levels deep) still represents risk but may be harder to remediate.\n\nKey graph metrics for risk assessment:\n- **In-degree**: How many components depend on this one (high in-degree = high blast radius)\n- **Shortest path to root**: Distance from application entry point (closer = more exploitable)\n- **Betweenness centrality**: Components that sit on many dependency paths (bottleneck risk)\n\n### Step 5: Calculate Risk Scores\n\nAggregate vulnerability data into component and overall risk scores:\n\n```\nRisk Score Calculation:\n━━━━━━━━━━━━━━━━━━━━━━\nComponent Risk = max(CVSS scores of all CVEs affecting the component)\n\nWeighted Risk = Component Risk * Dependency Factor\n  where Dependency Factor = 1.0 + (0.1 * in_degree)\n  (more dependents = higher organizational impact)\n\nOverall SBOM Risk = weighted average of all component risks\n  weighted by dependency centrality\n\nRisk Levels:\n  CRITICAL: CVSS >= 9.0 or known exploited (CISA KEV)\n  HIGH:     CVSS >= 7.0\n  MEDIUM:   CVSS >= 4.0\n  LOW:      CVSS \u003C 4.0\n```\n\n### Step 6: Cross-Validate with Grype\n\nUse grype to independently scan the SBOM and compare findings:\n\n```bash\n# Scan CycloneDX SBOM with grype\ngrype sbom:sbom-cyclonedx.json -o json > grype-results.json\n\n# Scan SPDX SBOM\ngrype sbom:sbom-spdx.json -o table\n\n# Filter by severity\ngrype sbom:sbom-cyclonedx.json --only-fixed --fail-on critical\n```\n\nGrype pulls vulnerability data from NVD, GitHub Security Advisories, Alpine SecDB, Red Hat, Debian, Ubuntu, Amazon Linux, and Oracle security databases, providing broader coverage than NVD alone.\n\n### Step 7: Generate Compliance Report\n\nProduce a structured report suitable for regulatory compliance:\n\n```\nSBOM VULNERABILITY ANALYSIS REPORT\n====================================\nSBOM File:         app-sbom-cyclonedx.json\nFormat:            CycloneDX v1.5\nAnalysis Date:     2026-03-19\nTotal Components:  247\nTotal Dependencies: 1,842 (direct: 34, transitive: 213)\n\nVULNERABILITY SUMMARY\n  Critical:  3 components \u002F 5 CVEs\n  High:      11 components \u002F 18 CVEs\n  Medium:    27 components \u002F 41 CVEs\n  Low:       8 components \u002F 12 CVEs\n\nCRITICAL FINDINGS\n1. lodash@4.17.20\n   CVE-2021-23337 (CVSS 7.2) - Command Injection via template\n   CVE-2020-28500 (CVSS 5.3) - ReDoS in trimEnd\n   Dependents: 14 components (high blast radius)\n   Fix: Upgrade to 4.17.21+\n\n2. log4j-core@2.14.1\n   CVE-2021-44228 (CVSS 10.0) - Log4Shell RCE [CISA KEV]\n   CVE-2021-45046 (CVSS 9.0) - Incomplete fix bypass\n   Dependents: 8 components\n   Fix: Upgrade to 2.17.1+\n\nDEPENDENCY GRAPH RISKS\n  Most depended-on: core-util@1.2.3 (47 dependents)\n  Deepest chain: app -> framework -> adapter -> codec -> zlib (5 levels)\n  Bottleneck components: 3 components on >50% of dependency paths\n\nLICENSE COMPLIANCE\n  Copyleft licenses found: 2 (GPL-3.0 in libxml2, AGPL-3.0 in mongodb-driver)\n  Review required for commercial distribution\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **SBOM** | Software Bill of Materials; a formal inventory of all components, libraries, and dependencies in a software product |\n| **CycloneDX** | OWASP-maintained SBOM standard supporting JSON, XML, and protobuf formats with dependency graph and vulnerability data |\n| **SPDX** | Linux Foundation SBOM standard focused on license compliance with support for package, file, and snippet-level detail |\n| **PURL** | Package URL; a standardized scheme for identifying software packages across ecosystems (e.g., pkg:npm\u002Flodash@4.17.21) |\n| **CPE** | Common Platform Enumeration; NIST naming scheme for IT products used to correlate with NVD CVE data |\n| **NVD** | National Vulnerability Database; US government repository of vulnerability data indexed by CVE identifiers |\n| **Transitive Dependency** | A dependency not directly declared but pulled in through the dependency chain of direct dependencies |\n| **CISA KEV** | CISA Known Exploited Vulnerabilities catalog; CVEs confirmed to be actively exploited in the wild |\n\n## Tools & Systems\n\n- **syft** (Anchore): Open-source SBOM generator supporting 30+ package ecosystems and CycloneDX\u002FSPDX output\n- **grype** (Anchore): Vulnerability scanner that accepts SBOMs as input and correlates against multiple advisory databases\n- **cyclonedx-python-lib**: Python library for creating, parsing, and validating CycloneDX SBOMs programmatically\n- **lib4sbom**: Python library for parsing both SPDX and CycloneDX format SBOMs\n- **nvdlib**: Python wrapper for the NVD 2.0 API supporting CVE and CPE queries with rate limit management\n- **OWASP Dependency-Track**: Platform for continuous SBOM analysis, vulnerability tracking, and policy enforcement\n\n## Common Scenarios\n\n### Scenario: Assessing Vendor Software After Log4Shell Disclosure\n\n**Context**: After the Log4Shell (CVE-2021-44228) disclosure, the security team needs to determine which vendor-supplied applications contain vulnerable versions of log4j. Several vendors have provided SBOMs per contractual requirements.\n\n**Approach**:\n1. Collect all vendor SBOMs (CycloneDX or SPDX JSON format)\n2. Parse each SBOM and search for log4j-core components with versions \u003C 2.17.1\n3. Query NVD API for the specific CVEs (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105)\n4. Build dependency graphs to identify which application components depend on log4j\n5. Calculate blast radius: how many services and endpoints are exposed\n6. Generate prioritized remediation report sorted by exposure and business criticality\n7. Cross-validate findings with grype scan of the same SBOMs\n\n**Pitfalls**:\n- Vendor SBOMs may be incomplete, missing shaded\u002Fbundled JAR files that embed log4j\n- SPDX and CycloneDX version differences may affect parser compatibility\n- NVD API rate limits can slow analysis when scanning hundreds of components without an API key\n- CPE names in SBOMs may not exactly match NVD entries, requiring fuzzy matching\n- Transitive dependencies may include log4j even when it is not a direct dependency\n","# Analyzing SBOM for Supply Chain Vulnerabilities\n\n## When to Use\n\n- A new regulatory requirement (EO 14028, EU CRA) mandates SBOM analysis for software deliveries\n- Security team needs to assess third-party risk by scanning vendor-provided SBOMs\n- CI\u002FCD pipeline requires automated vulnerability checks against generated SBOMs\n- Incident response needs to determine if a newly disclosed CVE affects deployed software\n- Procurement team requires supply chain risk assessment for a software acquisition\n\n**Do not use** for runtime vulnerability scanning of live systems; use container scanning tools (Trivy, Grype CLI) or host-based vulnerability scanners (Nessus, Qualys) instead.\n\n## Prerequisites\n\n- SBOM file in CycloneDX JSON (v1.4+) or SPDX JSON (v2.3+) format\n- Python 3.9+ with requests, networkx, and packaging libraries installed\n- NVD API key (free, from https:\u002F\u002Fnvd.nist.gov\u002Fdevelopers\u002Frequest-an-api-key) for higher rate limits\n- Network access to NVD API (https:\u002F\u002Fservices.nvd.nist.gov\u002Frest\u002Fjson\u002Fcves\u002F2.0)\n- Optionally: syft for SBOM generation, grype for cross-validation\n\n## Workflow\n\n### Step 1: Generate SBOM (if not provided)\n\nUse syft to create an SBOM from a container image or project directory:\n\n```bash\n# Generate CycloneDX JSON from a container image\nsyft alpine:latest -o cyclonedx-json > sbom-cyclonedx.json\n\n# Generate SPDX JSON from a project directory\nsyft dir:\u002Fpath\u002Fto\u002Fproject -o spdx-json > sbom-spdx.json\n\n# Generate from a running container\nsyft docker:my-app-container -o cyclonedx-json > sbom.json\n```\n\nSyft supports over 30 package ecosystems including npm, PyPI, Maven, Go modules, apt, apk, and RPM. The generated SBOM includes package names, versions, licenses, CPE identifiers, and PURL (Package URL) references.\n\n### Step 2: Parse SBOM and Extract Components\n\nParse the SBOM to extract all software components with their identifiers:\n\n**CycloneDX JSON Structure:**\n```json\n{\n  \"bomFormat\": \"CycloneDX\",\n  \"specVersion\": \"1.5\",\n  \"components\": [\n    {\n      \"type\": \"library\",\n      \"name\": \"lodash\",\n      \"version\": \"4.17.20\",\n      \"purl\": \"pkg:npm\u002Flodash@4.17.20\",\n      \"cpe\": \"cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:*:*:*\",\n      \"licenses\": [{\"license\": {\"id\": \"MIT\"}}]\n    }\n  ],\n  \"dependencies\": [\n    {\"ref\": \"pkg:npm\u002Fexpress@4.18.2\", \"dependsOn\": [\"pkg:npm\u002Flodash@4.17.20\"]}\n  ]\n}\n```\n\n**SPDX JSON Structure:**\n```json\n{\n  \"spdxVersion\": \"SPDX-2.3\",\n  \"packages\": [\n    {\n      \"name\": \"lodash\",\n      \"versionInfo\": \"4.17.20\",\n      \"externalRefs\": [\n        {\"referenceType\": \"purl\", \"referenceLocator\": \"pkg:npm\u002Flodash@4.17.20\"},\n        {\"referenceType\": \"cpe23Type\", \"referenceLocator\": \"cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:*:*:*\"}\n      ],\n      \"licenseConcluded\": \"MIT\"\n    }\n  ],\n  \"relationships\": [\n    {\"spdxElementId\": \"SPDXRef-express\", \"relatedSpdxElement\": \"SPDXRef-lodash\",\n     \"relationshipType\": \"DEPENDS_ON\"}\n  ]\n}\n```\n\n### Step 3: Correlate Components with NVD CVE Database\n\nQuery the NVD 2.0 API to find known vulnerabilities for each component:\n\n```python\nimport requests\n\nNVD_API = \"https:\u002F\u002Fservices.nvd.nist.gov\u002Frest\u002Fjson\u002Fcves\u002F2.0\"\n\ndef search_cves_by_cpe(cpe_name, api_key=None):\n    params = {\"cpeName\": cpe_name, \"resultsPerPage\": 50}\n    headers = {\"apiKey\": api_key} if api_key else {}\n    resp = requests.get(NVD_API, params=params, headers=headers, timeout=30)\n    resp.raise_for_status()\n    return resp.json().get(\"vulnerabilities\", [])\n\ndef search_cves_by_keyword(keyword, version=None, api_key=None):\n    params = {\"keywordSearch\": keyword, \"resultsPerPage\": 50}\n    headers = {\"apiKey\": api_key} if api_key else {}\n    resp = requests.get(NVD_API, params=params, headers=headers, timeout=30)\n    resp.raise_for_status()\n    return resp.json().get(\"vulnerabilities\", [])\n```\n\nThe NVD API supports searching by CPE name (most precise), keyword, CVE ID, and date ranges. Rate limits: 5 requests\u002F30 seconds without API key, 50 requests\u002F30 seconds with key.\n\n### Step 4: Build Dependency Graph and Identify Transitive Risks\n\nConstruct a directed graph of dependencies to trace vulnerability propagation:\n\n```python\nimport networkx as nx\n\ndef build_dependency_graph(sbom):\n    G = nx.DiGraph()\n    # Add nodes for each component\n    for comp in sbom[\"components\"]:\n        G.add_node(comp[\"purl\"], name=comp[\"name\"], version=comp[\"version\"])\n    # Add edges from dependency relationships\n    for dep in sbom.get(\"dependencies\", []):\n        for child in dep.get(\"dependsOn\", []):\n            G.add_edge(dep[\"ref\"], child)\n    return G\n```\n\nTransitive dependency analysis identifies components that are not directly included but are pulled in through dependency chains. A vulnerability in a deeply nested transitive dependency (e.g., 4 levels deep) still represents risk but may be harder to remediate.\n\nKey graph metrics for risk assessment:\n- **In-degree**: How many components depend on this one (high in-degree = high blast radius)\n- **Shortest path to root**: Distance from application entry point (closer = more exploitable)\n- **Betweenness centrality**: Components that sit on many dependency paths (bottleneck risk)\n\n### Step 5: Calculate Risk Scores\n\nAggregate vulnerability data into component and overall risk scores:\n\n```\nRisk Score Calculation:\n━━━━━━━━━━━━━━━━━━━━━━\nComponent Risk = max(CVSS scores of all CVEs affecting the component)\n\nWeighted Risk = Component Risk * Dependency Factor\n  where Dependency Factor = 1.0 + (0.1 * in_degree)\n  (more dependents = higher organizational impact)\n\nOverall SBOM Risk = weighted average of all component risks\n  weighted by dependency centrality\n\nRisk Levels:\n  CRITICAL: CVSS >= 9.0 or known exploited (CISA KEV)\n  HIGH:     CVSS >= 7.0\n  MEDIUM:   CVSS >= 4.0\n  LOW:      CVSS \u003C 4.0\n```\n\n### Step 6: Cross-Validate with Grype\n\nUse grype to independently scan the SBOM and compare findings:\n\n```bash\n# Scan CycloneDX SBOM with grype\ngrype sbom:sbom-cyclonedx.json -o json > grype-results.json\n\n# Scan SPDX SBOM\ngrype sbom:sbom-spdx.json -o table\n\n# Filter by severity\ngrype sbom:sbom-cyclonedx.json --only-fixed --fail-on critical\n```\n\nGrype pulls vulnerability data from NVD, GitHub Security Advisories, Alpine SecDB, Red Hat, Debian, Ubuntu, Amazon Linux, and Oracle security databases, providing broader coverage than NVD alone.\n\n### Step 7: Generate Compliance Report\n\nProduce a structured report suitable for regulatory compliance:\n\n```\nSBOM VULNERABILITY ANALYSIS REPORT\n====================================\nSBOM File:         app-sbom-cyclonedx.json\nFormat:            CycloneDX v1.5\nAnalysis Date:     2026-03-19\nTotal Components:  247\nTotal Dependencies: 1,842 (direct: 34, transitive: 213)\n\nVULNERABILITY SUMMARY\n  Critical:  3 components \u002F 5 CVEs\n  High:      11 components \u002F 18 CVEs\n  Medium:    27 components \u002F 41 CVEs\n  Low:       8 components \u002F 12 CVEs\n\nCRITICAL FINDINGS\n1. lodash@4.17.20\n   CVE-2021-23337 (CVSS 7.2) - Command Injection via template\n   CVE-2020-28500 (CVSS 5.3) - ReDoS in trimEnd\n   Dependents: 14 components (high blast radius)\n   Fix: Upgrade to 4.17.21+\n\n2. log4j-core@2.14.1\n   CVE-2021-44228 (CVSS 10.0) - Log4Shell RCE [CISA KEV]\n   CVE-2021-45046 (CVSS 9.0) - Incomplete fix bypass\n   Dependents: 8 components\n   Fix: Upgrade to 2.17.1+\n\nDEPENDENCY GRAPH RISKS\n  Most depended-on: core-util@1.2.3 (47 dependents)\n  Deepest chain: app -> framework -> adapter -> codec -> zlib (5 levels)\n  Bottleneck components: 3 components on >50% of dependency paths\n\nLICENSE COMPLIANCE\n  Copyleft licenses found: 2 (GPL-3.0 in libxml2, AGPL-3.0 in mongodb-driver)\n  Review required for commercial distribution\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **SBOM** | Software Bill of Materials; a formal inventory of all components, libraries, and dependencies in a software product |\n| **CycloneDX** | OWASP-maintained SBOM standard supporting JSON, XML, and protobuf formats with dependency graph and vulnerability data |\n| **SPDX** | Linux Foundation SBOM standard focused on license compliance with support for package, file, and snippet-level detail |\n| **PURL** | Package URL; a standardized scheme for identifying software packages across ecosystems (e.g., pkg:npm\u002Flodash@4.17.21) |\n| **CPE** | Common Platform Enumeration; NIST naming scheme for IT products used to correlate with NVD CVE data |\n| **NVD** | National Vulnerability Database; US government repository of vulnerability data indexed by CVE identifiers |\n| **Transitive Dependency** | A dependency not directly declared but pulled in through the dependency chain of direct dependencies |\n| **CISA KEV** | CISA Known Exploited Vulnerabilities catalog; CVEs confirmed to be actively exploited in the wild |\n\n## Tools & Systems\n\n- **syft** (Anchore): Open-source SBOM generator supporting 30+ package ecosystems and CycloneDX\u002FSPDX output\n- **grype** (Anchore): Vulnerability scanner that accepts SBOMs as input and correlates against multiple advisory databases\n- **cyclonedx-python-lib**: Python library for creating, parsing, and validating CycloneDX SBOMs programmatically\n- **lib4sbom**: Python library for parsing both SPDX and CycloneDX format SBOMs\n- **nvdlib**: Python wrapper for the NVD 2.0 API supporting CVE and CPE queries with rate limit management\n- **OWASP Dependency-Track**: Platform for continuous SBOM analysis, vulnerability tracking, and policy enforcement\n\n## Common Scenarios\n\n### Scenario: Assessing Vendor Software After Log4Shell Disclosure\n\n**Context**: After the Log4Shell (CVE-2021-44228) disclosure, the security team needs to determine which vendor-supplied applications contain vulnerable versions of log4j. Several vendors have provided SBOMs per contractual requirements.\n\n**Approach**:\n1. Collect all vendor SBOMs (CycloneDX or SPDX JSON format)\n2. Parse each SBOM and search for log4j-core components with versions \u003C 2.17.1\n3. Query NVD API for the specific CVEs (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105)\n4. Build dependency graphs to identify which application components depend on log4j\n5. Calculate blast radius: how many services and endpoints are exposed\n6. Generate prioritized remediation report sorted by exposure and business criticality\n7. Cross-validate findings with grype scan of the same SBOMs\n\n**Pitfalls**:\n- Vendor SBOMs may be incomplete, missing shaded\u002Fbundled JAR files that embed log4j\n- SPDX and CycloneDX version differences may affect parser compatibility\n- NVD API rate limits can slow analysis when scanning hundreds of components without an API key\n- CPE names in SBOMs may not exactly match NVD entries, requiring fuzzy matching\n- Transitive dependencies may include log4j even when it is not a direct dependency\n",{"name":5,"tags":57,"author":66,"domain":51,"license":15,"version":67,"nist_csf":68,"subdomain":73,"description":74,"nist_ai_rmf":75,"mitre_attack":81,"atlas_techniques":86},[36,58,59,60,61,62,63,64,65],"CycloneDX","SPDX","NVD","CVE","supply-chain","dependency-analysis","syft","grype","mukul975","1.0.0",[69,70,71,72],"GV.SC-01","GV.SC-03","GV.SC-06","GV.SC-07","supply-chain-security","Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX\u002FSPDX parsing, or CVE correlation.\n",[76,77,78,79,80],"GOVERN-5.2","MAP-1.6","MANAGE-2.2","GOVERN-1.1","GOVERN-4.2",[82,83,84,85],"T1195.001","T1195.002","T1554","T1190",[87,88],"AML.T0010","AML.T0104","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-sbom-for-supply-chain-vulnerabilities","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":98,"prompt":108,"zipAvailable":109},[99,102,105],{"tool":100,"command":101},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-sbom-for-supply-chain-vulnerabilities",{"tool":103,"command":104},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-sbom-for-supply-chain-vulnerabilities",{"tool":106,"command":107},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-sbom-for-supply-chain-vulnerabilities","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-sbom-for-supply-chain-vulnerabilities\u002FSKILL.md",true,[111,117,122,126,130,136],{"path":112,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"agents\u002Fopenai.yaml","REFERENCE","参考文档",87,"https:\u002F\u002Fgithub.com\u002FAb0umar\u002Fselrs.cc\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftdd\u002Fagents\u002Fopenai.yaml",{"path":118,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-sbom-for-supply-chain-vulnerabilities\u002FLICENSE",{"path":123,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":124,"sourceHtmlUrl":125},"mocking.md",1481,"https:\u002F\u002Fgithub.com\u002FAb0umar\u002Fselrs.cc\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftdd\u002Fmocking.md",{"path":127,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fapi-reference.md",6060,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-sbom-for-supply-chain-vulnerabilities\u002Freferences\u002Fapi-reference.md",{"path":131,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fagent.py","SCRIPT","脚本",28406,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-sbom-for-supply-chain-vulnerabilities\u002Fscripts\u002Fagent.py",{"path":137,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":138,"sourceHtmlUrl":139},"tests.md",2214,"https:\u002F\u002Fgithub.com\u002FAb0umar\u002Fselrs.cc\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Ftdd\u002Ftests.md",[141,180,189,198,220,245],{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":160,"publishedAt":52},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[148,151,154,157],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":158,"categoryName":159,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000034","行政与办公人员",[143,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":181,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":188,"publishedAt":52},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[184,185,186,187],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":158,"categoryName":159,"taxonomyType":29,"taxonomyTypeDesc":30},[143,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179],{"skillNo":190,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":197,"publishedAt":52},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[193,194,195,196],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":158,"categoryName":159,"taxonomyType":29,"taxonomyTypeDesc":30},[143,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179],{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":52},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[205,206,207,208,209,210,211,212,213,214,215,216,217,218,219],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":221,"name":222,"nameZh":6,"description":223,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":224,"categories":225,"keywords":227,"publishedAt":52},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[226],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[228,229,230,231,232,233,41,234,235,236,237,172,173,238,239,240,241,242,243,244],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":246,"name":247,"nameZh":6,"description":248,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":145,"licenseFileUrl":6,"sourceHtmlUrl":249,"categories":250,"keywords":261,"publishedAt":52},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[251,254,257,258],{"categoryNo":252,"categoryName":253,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":255,"categoryName":256,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":259,"categoryName":260,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",[262,263,264,265,266,267,268,269,169,270,172,173,174,271,272,273,274,275,219,276],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]