The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to generate SBOM files for internal projects using the snyk sbom command-line utility. This is a standard and documented functionality for creating security artifacts from source code.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted SBOM files (CycloneDX or SPDX JSON). This creates an attack surface where malicious instructions could be embedded in data fields like component names or versions. The skill mitigates this through a multi-phase workflow that includes format validation and structured reporting, and this risk is inherent to the skill's primary function of analyzing third-party data.

sbom-analyzer