Yocto Security Sbom
Review and debug Yocto license metadata, LIC_FILES_CHKSUM, LICENSE_FLAGS, incompatible licenses, license manifests, SPDX/SBOM generation, CVE checking, archiver/copyleft source compliance, and security policy. Use for compliance, CVE, SBOM, license, commercial license, source archiving, or security review questions.
Install
$ agentstack add skill-higangssh-yocto-agent-skills-yocto-security-sbom ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-higangssh-yocto-agent-skills-yocto-security-sbom) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Yocto Security SBOM
Use this skill for security, license, CVE, SBOM, and compliance workflows. Treat class names and output paths as release-sensitive.
Evidence
Ask for or inspect:
target Yocto release
recipe LICENSE and LIC_FILES_CHKSUM
license QA error
image/license manifest output
SPDX/SBOM configuration and output
CVE check configuration and reports
archiver/copyleft configuration
commercial license policyUseful commands:
bitbake -e | rg '^(LICENSE|LIC_FILES_CHKSUM|LICENSE_FLAGS|LICENSE_FLAGS_ACCEPTED|INCOMPATIBLE_LICENSE|CVE|SPDX|ARCHIVER)[:=]'
bitbake -c populate_lic
bitbake
find tmp/deploy -maxdepth 4 -iname '*spdx*' -o -path '*licenses*'Review Rules
LIC_FILES_CHKSUMis mandatory unlessLICENSE = "CLOSED".- License checksum mismatch means upstream license text changed; inspect before updating the checksum.
- Keep commercial license acceptance explicit and narrow.
- Verify current release SBOM/CVE class names before recommending
create-spdx, CVE classes, or output paths. - Use archiver/copyleft flows when source offer obligations matter.
- Do not confuse build-time
DEPENDSwith packages included in final image license manifests.
References
- Read [../../references/yocto/security-sbom.md](../../references/yocto/security-sbom.md).
- Read [../../references/bitbake/classes-core.md](../../references/bitbake/classes-core.md) for
license,archiver,create-spdx, and release-sensitive security classes. - Read [../../references/yocto/migration.md](../../references/yocto/migration.md) for SBOM/CVE release changes.
Output
Answer with:
- license/security artifact being debugged
- release-sensitive class or variable to verify
- exact metadata or policy fix
- validation command and expected artifact
- compliance caveat if legal interpretation is required
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Higangssh
- Source: Higangssh/yocto-agent-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.