openshift-eng/AI SBOM Generate
plugins/ai-sbom/skills/generate/SKILL.md
Generate an AI SBOM declaration for a PR description. Use this skill when the user asks to generate an AI SBOM, create an ai-assisted block, fill out their AI assistance section, or prepare a PR description with AI provenance. Also use when the user says 'what skills did I use' or 'summarize my AI usage'.
$ install --global
skillsauthnpx skillsauth add openshift-eng/ai-helpers AI SBOM GenerateInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 6, 2026, 6:22 AM123.1s1 file scanned
SKILL.md
- name:
- AI SBOM Generate
- description:
- Generate an AI SBOM declaration for a PR description. Use this skill when the user asks to generate an AI SBOM, create an ai-assisted block, fill out their AI assistance section, or prepare a PR description with AI provenance. Also use when the user says 'what skills did I use' or 'summarize my AI usage'.
Generate AI SBOM Declaration
Generate a formatted ai-assisted code fence block for a PR description that declares which AI tools, models, and skills contributed to the work.
Modes
Current Session
When the user asks to generate an AI SBOM during an active session, you already know which skills were invoked. Collect the list from your own tool usage history in this conversation. Get the tool version by running claude --version.
Past Session
When the user wants an SBOM for a previous session or across multiple sessions:
- Identify the project directory:
~/.claude/projects/<project-path-with-dashes>/ - Run the extraction script:
python3 <ai-sbom-plugin-path>/scripts/extract_skills.py <path-to-session-or-project-dir> - The script outputs a JSON object with
skills,models, andtool_version. The tool version is extracted from the session transcript when available; if not found, it falls back to the currently installed version viaclaude --version.
Resolving Provenance
For each skill identified, resolve its version and source:
-
Read
~/.claude/plugins/installed_plugins.jsonto find the plugin entry- The key format is
plugin-name@marketplace-name(e.g.,superpowers@claude-plugins-official) - Extract
versionandgitCommitShafrom the entry
- The key format is
-
Read
~/.claude/plugins/known_marketplaces.jsonto find the source repo- Match the marketplace name to get the
source.repo(e.g.,anthropics/claude-plugins-official)
- Match the marketplace name to get the
-
For repo-local skills (
.claude/skills/), use therepo:prefix with no version -
For user-level skills (
~/.claude/skills/), use theuser:prefix with no version
Output Format
Read the format specification at plugins/ai-sbom/docs/AI_SBOM.md for the exact block structure, field definitions, skill entry format, and examples. Generate the ai-assisted code fence block following that spec.
Writing to a PR
When the user asks to write the SBOM to a PR:
- Find the PR for the current branch:
gh pr view --json number,body - Generate the SBOM block with the
## AI Assistanceheader - Check if the PR body already contains a
## AI Assistancesection- If yes, replace everything from
## AI Assistancethrough the closing```of theai-assistedfence - If no, append the section to the end of the PR body
- If yes, replace everything from
- Update the PR:
gh pr edit <number> --body "<updated body>" - Confirm to the user what was written
Steps
- Determine mode (current session or past session)
- Get the tool version by running
claude --version - Collect the list of skills used (from self-knowledge or extraction script)
- Read
~/.claude/plugins/installed_plugins.json - Read
~/.claude/plugins/known_marketplaces.json - For each skill, resolve: marketplace, version, source repo, commit SHA
- Check
.claude/skills/and~/.claude/skills/for repo-local and user-level skills - Format the
## AI Assistancesection with theai-assistedcode fence block - If the user wants it written to a PR, update the PR body using
gh pr edit - Otherwise, present it to the user for manual inclusion
Related Skills
openshift-eng/status-analysis
research
VerifiedTrustedCommunity
Shared engine for analyzing Jira issue activity and generating status summaries
98SKILL.mdUpdated Apr 28, 2026
openshift-eng/payload-snapshot
testing
VerifiedTrustedCommunity
Snapshot OpenShift payload data (release controller, PR diffs, comments, CI jobs, JUnit results, regression tracking) to a local directory for offline analysis
96SKILL.mdUpdated Jun 4, 2026
openshift-eng/payload-analysis
development
VerifiedTrustedCommunity
Analyze a payload snapshot to identify root causes of blocking job failures, score candidate PRs, and produce an HTML report with revert recommendations
96SKILL.mdUpdated Jun 4, 2026
openshift-eng/stage-payload-reverts
tools
VerifiedTrustedCommunity
Create TRT JIRA bugs, open revert PRs, and trigger payload jobs for high-confidence revert candidates
96SKILL.mdUpdated Apr 28, 2026