dependency-sbom-osv
Installation
SKILL.md
Dependency / SBOM → OSV queries
Turn project dependency files into OSV /v1/query or /v1/querybatch payloads. Pair with osv-vulnerability-scan for triage and reporting.
Workflow
- [ ] Detect manifest/lockfile type
- [ ] Prefer lockfile versions (exact) over range-only manifests
- [ ] Map each package → { ecosystem, name, version } or purl
- [ ] Batch via /v1/querybatch (then GET /v1/vulns/{id})
- [ ] Deduplicate transitive duplicates before querying when possible