CycloneDX SBOM Component & License Diff
Compare two CycloneDX JSON SBOMs and review added or removed components plus declared-license changes locally.
$7
Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
GitHub Copilot
Gemini CLI+20 moreClaude CodeCursorCodex CLIGitHub CopilotGemini CLI
OpenClaw
Manus
Grok+17 agentsCycloneDX SBOM Component & License Diff
Example session with this skill installed
Compare the included invented before and after CycloneDX JSON BOM examples. Show the component identity and declared-license changes, then list what a human must verify before release. Do not make a legal compliance conclusion.
- Read your context and instructions
- Compiled the cyclonedx sbom component
CycloneDX component and license declaration review
Status: REVIEW. Both invented BOMs contain 2 top-level components. The sample packet records 1 added component, 1 removed component and 1 changed license declaration.
| Finding | Component identity | Before declaration | After declaration |
|---|---|---|---|
| REMOVED_COMPONENT | example/format 2.0.0 | Apache-2.0 | — |
| ADDED_COMPONENT | example/format 2.1.0 | — | Apache-2.0 |
| LICENSE_DECLARATION_CHANGED | example/parser 1.0.0 | MIT | BSD-3-Clause |
A version change is represented as a removed identity plus an added identity; it does not prove a removal from the software distribution. The license values are only declarations in the supplied BOMs. The tool has not checked source files, obligations, vulnerabilities, dependencies, services or the complete CycloneDX schema.
The delivery packet contains component-license-delta.json, HUMAN_REVIEW.md and an integrity receipt. Next, confirm that both BOMs cover the intended releases and generators; inspect the changed identities and declarations; run a full CycloneDX validator and qualified license review where needed. Do not treat this card as a legal or security verdict.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
A release can change components or license declarations even when the application still builds normally. This local checker compares two CycloneDX JSON BOMs and creates a review queue for component identities and supplied license fields. It does not scan vulnerabilities, interpret legal obligations or validate the entire SBOM.
Includes installable Python source, CLI, optional local MCP adapter, Skill, invented BOM examples and sample packet. Python 3.11–3.14; optional MCP mode installs the pinned official SDK. This is a review queue for top-level component identity and supplied license declaration fields. It does not validate the full SBOM, scan vulnerabilities, interpret license obligations or prove declarations correct. Reads two selected local JSON files and creates a new local output directory. No repository access, credentials or network at runtime.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 12 days ago
- Passed all security checks, Safe to install