Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add UnitOneAI/SecuritySkills --skill sbom-analysisgit clone --depth 1 https://github.com/UnitOneAI/SecuritySkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/unitoneai/securityskills/sbom-analysis)<a href="https://agentmods.dev/skills/unitoneai/securityskills/sbom-analysis"><img src="https://agentmods.dev/badge/skills/unitoneai/securityskills/sbom-analysis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/unitoneai/securityskills/sbom-analysis"><img src="https://agentmods.dev/badge/skills/unitoneai/securityskills/sbom-analysis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00089 | $0.05816 |
| Opus 5.5 | $0.00036 | $0.02326 |
| Sonnet 5.5 | $0.00018 | $0.01163 |
| Haiku 4.5 | $0.00009 | $0.00582 |
Grade A, and why
sbom-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 421 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SBOM Analysis & VEX Review -- CycloneDX 1.5 / SPDX 2.3 / VEX (CSAF) / NTIA Minimum Elements
Frameworks: CycloneDX 1.5 (OWASP), SPDX 2.3 (Linux Foundation / ISO 5962), VEX via CSAF 2.0 (OASIS), NTIA SBOM Minimum Elements Role: Security Engineer, AppSec Engineer Time: 20-40 min Output: SBOM completeness assessment, VEX status summary, dependency risk analysis, and license conflict report
When to Use
If a target is provided via arguments, focus the review on: $ARGUMENTS
Use this skill when an SBOM file (CycloneDX or SPDX format) is shared for review, when evaluating software supply chain risk for a vendor or internal application, when VEX documents need interpretation to determine actual exploitability, when assessing SBOM completeness for regulatory compliance (EO 14028, EU CRA), or when performing transitive dependency analysis for known vulnerabilities.
Do not use when: The task is triaging a specific CVE without SBOM context (use cve-triage), performing runtime vulnerability scanning (use scanner-tuning), or reviewing source code for security flaws (use secure-code-review).
Context the Agent Needs
Before starting, collect or confirm:
- SBOM file(s): The actual SBOM document(s) in CycloneDX (JSON/XML) or SPDX (JSON/RDF/tag-value) format
- SBOM format and version: CycloneDX 1.5, SPDX 2.3, or other (identify version explicitly)
- VEX document(s): Associated VEX statements, if available (CSAF 2.0 format, CycloneDX VEX, or OpenVEX)
- Software identity: Name, version, and vendor of the software the SBOM describes
- Intended use context: Is this SBOM for procurement evaluation, compliance audit, incident response, or continuous monitoring?
- Compliance requirements: Applicable mandates (EO 14028 for US federal suppliers, EU Cyber Resilience Act, FDA premarket guidance for medical devices)
- License policy: Organization's approved/prohibited license list, if applicable
- Known vulnerability data: CVE data sources to cross-reference (NVD, OSV, GitHub Advisory Database)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 421 lines · 89 tokens per session scan A d8109bc56e4d
sbom-analysis is a skill published in the GitHub repository UnitOneAI/SecuritySkills (97 stars, last pushed 4mo ago), licensed MIT. It adds 89 tokens to every session and 5,816 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vulnerability-scanner
A security scanner that checks software dependencies for known vulnerabilities, analyzes whether they can be reached, creates a software bill of materials, and audits licenses.
agent-bom-compliance
AI compliance and policy engine — evaluate scan results against OWASP, NIST, SOC 2, ISO 27001, CMMC, EU AI Act, AISVS v1.0, and related frameworks. Generate SBOMs and compliance reports. Use when: "compliance report", "NIST", "SOC 2", "ISO 27001", "OWASP", "EU AI Act", "AISVS", "generate SBOM", "policy check".
playbook-social-engineering
Social engineering assessment — phishing campaigns, vishing, physical tests, GoPhish setup. Load when the engagement scope explicitly includes social engineering or physical testing.
performing-container-security-scanning-with-trivy
Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.
gdpr-audit
GDPR compliance audit of code, plans, schemas, or IaC. Produces a findings report with article citations, severity, confidence, and fixes; flags evidence gaps. Not a substitute for a DPO/lawyer.
cis-aws-foundations-2.12
Ensure access keys are rotated every 90 days or less.