Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add seaworld008/Commonly-used-high-value-skills --skill grype-syft-sbom-scannergit clone --depth 1 https://github.com/seaworld008/Commonly-used-high-value-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seaworld008/commonly-used-high-value-skills/grype-syft-sbom-scanner)<a href="https://agentmods.dev/skills/seaworld008/commonly-used-high-value-skills/grype-syft-sbom-scanner"><img src="https://agentmods.dev/badge/skills/seaworld008/commonly-used-high-value-skills/grype-syft-sbom-scanner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/seaworld008/commonly-used-high-value-skills/grype-syft-sbom-scanner"><img src="https://agentmods.dev/badge/skills/seaworld008/commonly-used-high-value-skills/grype-syft-sbom-scanner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 184 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 185 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.01365 |
| Opus 5 | $0.00023 | $0.00682 |
| Sonnet 5 | $0.00009 | $0.00273 |
| Haiku 4.5 | $0.00005 | $0.00136 |
Grade A, and why
grype-syft-sbom-scanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 194 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Grype + Syft SBOM Scanner
Trigger / When to Use
Use this skill when the user wants SBOM-first vulnerability management, container image scanning, package inventory, or repeatable vulnerability scans using Anchore open-source tools Syft and Grype.
Good trigger phrases:
- "generate an SBOM and scan it"
- "scan this container with Grype"
- "compare vulnerabilities between two images"
- "produce CycloneDX or SPDX"
- "scan a directory or archive for CVEs"
- "make vulnerability results reproducible from SBOM"
Core Capabilities
- Generate SBOMs from container images, directories, files, archives, and package metadata with Syft.
- Scan container images, directories, SBOMs, and individual package identifiers with Grype.
- Separate inventory generation from vulnerability matching for repeatable audits.
- Compare scan results over time as vulnerability databases change.
- Integrate SBOM and vulnerability outputs into CI/CD and release evidence.
- Support SPDX, CycloneDX, and Syft JSON workflows.
Workflow
1. Pick the SBOM Strategy
Use one of these modes:
- Direct Grype scan for quick triage.
- Syft SBOM plus Grype scan for reproducibility.
- Stored SBOM scan for release, compliance, or incident response.
Prefer SBOM-first when the result will be attached to a release, shared with customers, or compared later.
2. Verify Tools
syft version
grype version
If missing, install from official Anchore channels. Pin versions in CI when release evidence matters.
3. Generate an SBOM
For a container image:
syft registry.example.com/app:1.2.3 -o cyclonedx-json=sbom.cdx.json
For a local source or filesystem directory:
syft dir:. -o spdx-json=sbom.spdx.json
For Syft JSON:
syft packages . -o syft-json=sbom.syft.json
4. Scan with Grype
Scan an image directly:
grype registry.example.com/app:1.2.3
Scan a directory:
grype dir:.
Scan an SBOM:
grype sbom:sbom.cdx.json
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 194 lines · 45 tokens per session scan A 3a1762c57fc9
grype-syft-sbom-scanner is a skill published in the GitHub repository seaworld008/Commonly-used-high-value-skills (70 stars, last pushed 5d ago), licensed MIT. It adds 45 tokens to every session and 1,365 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-docker-container-forensics
Use when investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence. Use when working with analyzing docker container forensics.
analyzing-kubernetes-audit-logs
Use when parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns. Use when investigating Kubernetes cluster compromise or building k8s-specific SIEM…
kubernetes-best-practices
Provides production-ready Kubernetes manifest guidance including resource management, security, high availability, and configuration best practices. This skill should be used when working with Kubernetes YAML files, deployments, pods, services, or when users mention k8s, container orchestration, or cloud-native…
image-security-scanner
Scans Docker images for security vulnerabilities, outdated packages, and misconfigurations. Use when checking image security, finding vulnerabilities, or hardening containers.
cloud-build-helper
Configures Google Cloud Build pipelines with caching, parallel builds, and optimization. Use when setting up Cloud Build, optimizing build performance, or configuring CI/CD pipelines.
proxmox-cluster-ops
Operate a Proxmox VE cluster safely — read-only inspection with pvesh/pct/qm/pvecm instead of hand-editing a live guest, node-by-node package updates that respect quorum, and the shape of joining a new node to an existing cluster. Use when inspecting cluster or guest state, planning a rolling update across cluster…