From secdb-skills
Audit a CycloneDX Software Bill of Materials (SBOM) file for known vulnerabilities using ZEN SecDB purl_audit. Use when the user provides or mentions a bom.json or bom.xml CycloneDX file and wants to check it for vulnerabilities.
How this skill is triggered — by the user, by Claude, or both
Slash command
/secdb-skills:secdb-sbom-auditThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Audit a CycloneDX Software Bill of Materials (SBOM) file for known vulnerabilities using ZEN SecDB.
Audit a CycloneDX Software Bill of Materials (SBOM) file for known vulnerabilities using ZEN SecDB.
The ZEN SecDB MCP server must be configured. See README.md for setup instructions.
/secdb-sbom-audit [path/to/bom.json]
If no path is provided, scan the current directory for bom.json or bom.xml files.
Locate the SBOM file — use the path provided, or search for bom.json / bom.xml in the project root.
Parse the components from the CycloneDX BOM:
$.components[*] entries<components><component> elementspurl field from each componentFilter PURLs — only submit supported ecosystems to purl_audit:
pkg:npm, pkg:pypi, pkg:gem, pkg:golang, pkg:maven, pkg:cargo, pkg:nuget, pkg:composerCall purl_audit with the filtered PURL list.
Present results:
report JSON in the responseThe report JSON contains the full advisory data and can be used for detailed analysis.
Additional ZEN SecDB MCP tools are available for deeper investigation on specific CVEs:
vulnerability_info — full CVE details (description, references, affected versions)vulnerability_score — CVSS and current EPSS scoreepss_timeseries — historical EPSS trend for a CVEsightings_search — real-world exploitation sightingsssvc_calculator — CISA SSVC prioritization scoreUse these tools when the user wants to investigate a specific CVE in depth, assess exploitability, or prioritize remediation.
Provides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Searches MemPalace before answering questions about past work, people, projects, or prior decisions. Returns verbatim stored content instead of guessing from model memory.
npx claudepluginhub giterlizzi/secdb-skills --plugin secdb-skills