Skip to content
Open-source supply-chain tooling for agent skills

A bill of materialsfor the skillsyour agents run.

Agent skills steer what your AI does. SkillBOM records what’s in each one, what it was built from, and whether the skills you installed are the ones that were released. A CycloneDX profile and a small CLI, so it works with the SBOM tools you already use.

Terminal
pip install "git+https://github.com/grcmana/skillbom@v0.0.1"
Get SkillBOM on GitHub →

Then run skillbom verify .claude/skills. Python 3.10+, no dependencies. Free under Apache-2.0. Experimental.

Why a bill of materials

Installing a skill is a supply-chain decision.

A skill is a folder of instructions, reference material and sometimes scripts that an agent follows. Most people install one with a single command and never look again.

That leaves basic questions unanswered. Is this the version that was released, or has something changed? What reference material is it relying on, and how old is it? Does it ship code that can run on your machine?

Software has had bills of materials for years. SkillBOM brings the same discipline to agent skills: a fingerprint of every file, a record of what each skill was built from, and a signature from the publisher.

What a Skill BOM records

IdentityName, version, licence and author, read from each SKILL.md.
IntegrityA SHA-256 fingerprint of every file, and one for the whole skill.
Knowledge provenanceThe reference material each skill ships, with the date it was last checked against its source.
CapabilitiesThe role of every file, so you can see at a glance whether a skill ships scripts.
EvidenceComing in profile 0.2Test results, pinned to the exact version they ran against.
Three commands

Three commands. Publisher to user.

  1. 01

    skillbom generate

    For publishers, at release. Builds the BOM from your skills repository. Same files in, same bytes out, every time.

  2. 02

    skillbom check

    For publishers, in CI. Applies policy rules: every skill versioned and licensed, every file fingerprinted, no stale knowledge.

  3. 03

    skillbom verify

    For users, after installing. Compares the skills on your machine with the publisher’s BOM and lists every file that was added, removed or changed.

Read the user guide →

What it proves, and what it doesn’t

Honest about its limits.

It proves

  • The files you have match the files that were released.
  • Who produced the BOM, and that it hasn’t changed since. (Releases are signed with GitHub artifact attestations.)
  • Which knowledge each skill ships, and the date its author declared for it.
  • Whether a skill ships executable scripts.

It doesn’t prove

  • That a skill gives correct or safe advice.
  • That the publisher is trustworthy.
  • That the knowledge is actually up to date. The date is the author’s claim.
  • What a bundled script does.

Read the threat model →

Built on standards

Not another format.

A Skill BOM is a valid CycloneDX 1.6 document, so it opens in the SBOM tooling, validators and review processes you already have. Everything specific to skills is carried in standard fields or clearly namespaced properties. The fingerprint can be reproduced with find, sort and sha256sum.

  • CycloneDX 1.6
  • Content hashed
  • Signed releases
  • Drift detection
  • Open source

Read the specification →

Family

Part of a wider effort

FAQ

Questions, answered.

A bill of materials for agent skills: a file that lists every skill in a release, every file in each skill with its fingerprint, and the reference material each skill relies on. It’s a CycloneDX 1.6 document following the Skill BOM profile.

No. It works with any folder containing a SKILL.md, the Agent Skills format used by Claude Code and other agents. GRC Skills is simply the first project to use it.

No. A pass means the files you have are the files that were released, nothing more. Whether a skill is correct or safe is a separate question that needs review and testing.

That the BOM came from the publisher’s release workflow and hasn’t been altered since. You can check it with gh attestation verify. It doesn’t prove the contents are true.

No. It runs locally, makes no network requests and only writes the file you ask it to.

Add a few lines to your release workflow: generate the BOM, sign it, attach it to the release. The user guide has a copy-and-paste example for GitHub Actions.

Not yet. SkillBOM is experimental (0.0.x) and the profile may change. Feedback is welcome in GitHub issues.

Profile 0.2 will record test results against each skill, pinned to the exact version they ran against, so you can tell when evidence is out of date. See the roadmap.

Nothing. The code is Apache-2.0 and the specification is CC-BY-4.0.

SkillBOM is maintained by Harry West at GRCMANA. Built by a former Global CISO: GRCP certified, and Certified Lead Implementer for ISO 27001, ISO 27701 and ISO 42001.

Know what your agents are running.

Terminal
pip install "git+https://github.com/grcmana/skillbom@v0.0.1"
View on GitHub →