# Yocto Security Sbom

> Review and debug Yocto license metadata, LIC_FILES_CHKSUM, LICENSE_FLAGS, incompatible licenses, license manifests, SPDX/SBOM generation, CVE checking, archiver/copyleft source compliance, and security policy. Use for compliance, CVE, SBOM, license, commercial license, source archiving, or security review questions.

- **Type:** Skill
- **Install:** `agentstack add skill-higangssh-yocto-agent-skills-yocto-security-sbom`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Higangssh](https://agentstack.voostack.com/s/higangssh)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Higangssh](https://github.com/Higangssh)
- **Source:** https://github.com/Higangssh/yocto-agent-skills/tree/main/skills/yocto-security-sbom

## Install

```sh
agentstack add skill-higangssh-yocto-agent-skills-yocto-security-sbom
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Yocto Security SBOM

Use this skill for security, license, CVE, SBOM, and compliance workflows. Treat class names and output paths as release-sensitive.

## Evidence

Ask for or inspect:

```text
target Yocto release
recipe LICENSE and LIC_FILES_CHKSUM
license QA error
image/license manifest output
SPDX/SBOM configuration and output
CVE check configuration and reports
archiver/copyleft configuration
commercial license policy
```

Useful commands:

```bash
bitbake -e  | rg '^(LICENSE|LIC_FILES_CHKSUM|LICENSE_FLAGS|LICENSE_FLAGS_ACCEPTED|INCOMPATIBLE_LICENSE|CVE|SPDX|ARCHIVER)[:=]'
bitbake -c populate_lic 
bitbake 
find tmp/deploy -maxdepth 4 -iname '*spdx*' -o -path '*licenses*'
```

## Review Rules

- `LIC_FILES_CHKSUM` is mandatory unless `LICENSE = "CLOSED"`.
- License checksum mismatch means upstream license text changed; inspect before updating the checksum.
- Keep commercial license acceptance explicit and narrow.
- Verify current release SBOM/CVE class names before recommending `create-spdx`, CVE classes, or output paths.
- Use archiver/copyleft flows when source offer obligations matter.
- Do not confuse build-time `DEPENDS` with packages included in final image license manifests.

## References

- Read [../../references/yocto/security-sbom.md](../../references/yocto/security-sbom.md).
- Read [../../references/bitbake/classes-core.md](../../references/bitbake/classes-core.md) for `license`, `archiver`, `create-spdx`, and release-sensitive security classes.
- Read [../../references/yocto/migration.md](../../references/yocto/migration.md) for SBOM/CVE release changes.

## Output

Answer with:

1. license/security artifact being debugged
2. release-sensitive class or variable to verify
3. exact metadata or policy fix
4. validation command and expected artifact
5. compliance caveat if legal interpretation is required

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Higangssh](https://github.com/Higangssh)
- **Source:** [Higangssh/yocto-agent-skills](https://github.com/Higangssh/yocto-agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-higangssh-yocto-agent-skills-yocto-security-sbom
- Seller: https://agentstack.voostack.com/s/higangssh
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.