sbom-generate

# Vulnetix SBOM Generate Skill ## Use when - Producing an SBOM for SOC 2 / supply-chain compliance. - Attaching an SBOM to a release artefact (GitHub release, container registry). - Submitting to an SBOM registry (e.g. NTIA, in-house). - Cosign signing for keyless OIDC supply-chain attestation. - Cross-validating Vulnetix output against syft for component-count drift. ## Don't use for - Just the license list — use `/vulnetix:license-check`. - Full compliance bundle (SBOM + VEX + SARIF) — use `/vulnetix:compliance-report`. - Container-image SBOM — use `/vulnetix:container-scan` with syft composition. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Use `binaries.cosign` to gate signing. If user asks for `--sign` without cosign, surface install hint and skip signing. ## Step 2: Generate ```bash OUT="${OUTPUT_DIR:-.vulnetix/sboms/$(date -u +%Y%m%dT%H%M%SZ)}" mkdir -p "$OUT" if [[ "$FORMAT" == "cyclonedx" ]] || [[ "$FORMAT" == "both" ]]; then vulnetix scan -o json-cyclonedx > "$OUT/sbom.cdx.json" fi if [...