openshift-eng/AI SBOM Generate
plugins/ai-sbom/skills/generate/SKILL.md
Generate an AI SBOM declaration for a PR description. Use this skill when the user asks to generate an AI SBOM, create an ai-assisted block, fill out their AI assistance section, or prepare a PR description with AI provenance. Also use when the user says 'what skills did I use' or 'summarize my AI usage'.
$ install --global
skillsauthnpx skillsauth add openshift-eng/ai-helpers AI SBOM GenerateInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 6, 2026, 6:22 AM123.1s1 file scanned
SKILL.md
- name:
- AI SBOM Generate
- description:
- Generate an AI SBOM declaration for a PR description. Use this skill when the user asks to generate an AI SBOM, create an ai-assisted block, fill out their AI assistance section, or prepare a PR description with AI provenance. Also use when the user says 'what skills did I use' or 'summarize my AI usage'.
Generate AI SBOM Declaration
Generate a formatted ai-assisted code fence block for a PR description that declares which AI tools, models, and skills contributed to the work.
Modes
Current Session
When the user asks to generate an AI SBOM during an active session, you already know which skills were invoked. Collect the list from your own tool usage history in this conversation. Get the tool version by running claude --version.
Past Session
When the user wants an SBOM for a previous session or across multiple sessions:
- Identify the project directory:
~/.claude/projects/<project-path-with-dashes>/ - Run the extraction script:
python3 <ai-sbom-plugin-path>/scripts/extract_skills.py <path-to-session-or-project-dir> - The script outputs a JSON object with
skills,models, andtool_version. The tool version is extracted from the session transcript when available; if not found, it falls back to the currently installed version viaclaude --version.
Resolving Provenance
For each skill identified, resolve its version and source:
-
Read
~/.claude/plugins/installed_plugins.jsonto find the plugin entry- The key format is
plugin-name@marketplace-name(e.g.,superpowers@claude-plugins-official) - Extract
versionandgitCommitShafrom the entry
- The key format is
-
Read
~/.claude/plugins/known_marketplaces.jsonto find the source repo- Match the marketplace name to get the
source.repo(e.g.,anthropics/claude-plugins-official)
- Match the marketplace name to get the
-
For repo-local skills (
.claude/skills/), use therepo:prefix with no version -
For user-level skills (
~/.claude/skills/), use theuser:prefix with no version
Output Format
Read the format specification at plugins/ai-sbom/docs/AI_SBOM.md for the exact block structure, field definitions, skill entry format, and examples. Generate the ai-assisted code fence block following that spec.
Writing to a PR
When the user asks to write the SBOM to a PR:
- Find the PR for the current branch:
gh pr view --json number,body - Generate the SBOM block with the
## AI Assistanceheader - Check if the PR body already contains a
## AI Assistancesection- If yes, replace everything from
## AI Assistancethrough the closing```of theai-assistedfence - If no, append the section to the end of the PR body
- If yes, replace everything from
- Update the PR:
gh pr edit <number> --body "<updated body>" - Confirm to the user what was written
Steps
- Determine mode (current session or past session)
- Get the tool version by running
claude --version - Collect the list of skills used (from self-knowledge or extraction script)
- Read
~/.claude/plugins/installed_plugins.json - Read
~/.claude/plugins/known_marketplaces.json - For each skill, resolve: marketplace, version, source repo, commit SHA
- Check
.claude/skills/and~/.claude/skills/for repo-local and user-level skills - Format the
## AI Assistancesection with theai-assistedcode fence block - If the user wants it written to a PR, update the PR body using
gh pr edit - Otherwise, present it to the user for manual inclusion
Related Skills
openshift-eng/jira-solve
tools
VerifiedTrustedCommunity
Analyze a JIRA issue and create a pull request to solve it. Use when the user wants to implement a fix or feature described in a Jira issue, push a branch, and open a draft PR.
112SKILL.mdUpdated Jul 29, 2026
openshift-eng/deep-review
development
VerifiedTrustedCommunity
Use when a deeper level of code review is requested. Multi-agent panel code review with specialist reviewers and forced runtime reproducers for all BLOCKING bug findings. Optionally posts to GitHub/GitLab as a PENDING review.
112SKILL.mdUpdated Jul 29, 2026
openshift-eng/review-docs
development
VerifiedTrustedCommunity
Review agentic documentation — verify claims locally against source code first, then use chai-bot for cross-repo and cross-functional verification
112SKILL.mdUpdated Jul 10, 2026
openshift-eng/prow-job-analysis
development
VerifiedTrustedCommunity
Use this skill when debugging a failed Prow CI job.
112SKILL.mdUpdated Jul 9, 2026