Bombastic — Security skill for Claude Code

Bombastic SBOM Generator

This skill helps you create comprehensive Software Bill of Materials documents for compliance, supply chain security, license tracking and dependency management.

When to Use

Generate an SBOM when you need to:

• Compliance: Document all components and dependencies for regulatory audits
• Supply chain security: Identify and track vulnerable components
• Dependency management: Understand what's in your codebase at a point in time
• Vulnerability scanning: Cross-reference dependencies against known vulnerabilities
• Audit trails: Create timestamped records of software composition

Workflow Overview

The skill works in three main phases:

1. Extract dependencies from your source code (Git repo or manifests)
2. Generate SBOMs in your chosen format(s) with metadata
3. Validate and optionally check for known vulnerabilities

Phase 1: Extracting Dependencies

From a Git Repository

Use syft to automatically scan the repository:

syft  -o json > sbom-raw.json

This discovers dependencies from all detected package managers and lock files in the repo.

From Package Manifests

If you prefer manual extraction or have specific manifests:

**Node.js (package.json):**

• Use npm list --json or yarn list --json to get dependency tree
• Include lock file hash (from package-lock.json or yarn.lock)

**Python (requirements.txt / Pipenv / Poetry):**

• Extract from requirements.txt or poetry.lock
• For each dependency, note version, Python version compatibility

**Java (pom.xml, build.gradle):**

• Use Maven's dependency tree plugin: mvn dependency:tree -DoutputFile=deps.txt
• Or gradle: ./gradlew dependencies

**Ruby (Gemfile):**

• Use bundle list --path to get versions
• Check Gemfile.lock for exact pinned versions

**Go (go.mod, go.sum):**

• Parse go.mod for direct dependencies
• Cross-reference with go.sum for hashes

Enriching with Metadata

For each component, collect: