From 1704f0d4c8aa4ab8eae14c047d9374c6930ad62b Mon Sep 17 00:00:00 2001 From: masahiroid Date: Wed, 21 Oct 2026 22:31:58 +0900 Subject: [PATCH 1/5] Add SecuLens and SBOM Vulnerability Scanner to Tool Center Signed-off-by: masahiroid --- tools/sbom_vulnerability_scanner.json | 37 +++++++++++++++++++ tools/seculens.json | 51 +++++++++++++++++++++++++++ 2 files changed, 88 insertions(+) create mode 100644 tools/sbom_vulnerability_scanner.json create mode 100644 tools/seculens.json diff --git a/tools/sbom_vulnerability_scanner.json b/tools/sbom_vulnerability_scanner.json new file mode 100644 index 0000000..27f5e27 --- /dev/null +++ b/tools/sbom_vulnerability_scanner.json @@ -0,0 +1,37 @@ +{ + "$schema": "https://cyclonedx.org/schema/tool-center-v2.tool.schema.json", + "specVersion": "2.0", + "tool": { + "publisher": "Masahiro NAKATSUGAWA", + "capabilities": [ + "SBOM" + ], + "availability": [ + "OPEN_SOURCE", + "OSI_APPROVED" + ], + "functions": [ + "ANALYSIS", + "AUTHOR" + ], + "supportedStandards": [ + "CYCLONEDX", + "SPDX", + "PACKAGE_URL" + ], + "name": "SBOM Vulnerability Scanner", + "description": "VS Code extension that generates and imports CycloneDX/SPDX JSON SBOMs, explores dependencies and licenses, scans known vulnerabilities using Trivy or npm audit, and exports HTML, JSON and Word reports.", + "repository_url": "https://github.com/masahiroid/sbom-vulnerability-scanner", + "website_url": "https://marketplace.visualstudio.com/items?itemName=masahirocom.sbom-vulnerability-scanner", + "analysis": [ + "SECURITY_VULNERABILITIES", + "LICENSE_REPORTING" + ], + "packaging": [ + "APPLICATION" + ], + "cycloneDxVersion": [ + "CYCLONEDX_V1.4" + ] + } +} diff --git a/tools/seculens.json b/tools/seculens.json new file mode 100644 index 0000000..48c2a95 --- /dev/null +++ b/tools/seculens.json @@ -0,0 +1,51 @@ +{ + "$schema": "https://cyclonedx.org/schema/tool-center-v2.tool.schema.json", + "specVersion": "2.0", + "tool": { + "publisher": "Masahiro NAKATSUGAWA", + "capabilities": [ + "SBOM" + ], + "availability": [ + "OPEN_SOURCE", + "OSI_APPROVED" + ], + "functions": [ + "ANALYSIS", + "AUTHOR" + ], + "supportedStandards": [ + "CYCLONEDX", + "SPDX", + "PACKAGE_URL" + ], + "name": "SecuLens", + "description": "CLI and library that reads CycloneDX and SPDX JSON SBOMs, matches npm, PyPI and Composer dependencies against OSV records, evaluates license policies and produces Word/JSON reports. Generates npm SBOMs using npm sbom.", + "repository_url": "https://github.com/masahiroid/seculens", + "website_url": "https://github.com/masahiroid/seculens#readme", + "analysis": [ + "SECURITY_VULNERABILITIES", + "LICENSE_REPORTING", + "POLICY_EVALUATION" + ], + "packaging": [ + "COMMAND_LINE_UTILITY", + "LIBRARY" + ], + "library": [ + "JAVASCRIPT_TYPESCRIPT", + "NODE.JS" + ], + "cycloneDxVersion": [ + "CYCLONEDX_V1.7", + "CYCLONEDX_V1.6", + "CYCLONEDX_V1.5", + "CYCLONEDX_V1.4" + ], + "supportedLanguages": [ + "NODE.JS", + "PYTHON", + "PHP" + ] + } +} From b11ec639f441e64a3f5e1649b11934b5d6c3baa3 Mon Sep 17 00:00:00 2001 From: masahiroid Date: Thu, 5 Nov 2026 20:58:34 +0900 Subject: [PATCH 2/5] fix: remove AUTHOR claim and rename scanner tool file Both tools generate or analyze BOMs automatically rather than letting a human author them by hand (see #130). Use a publisher-scoped file name for the scanner. Co-Authored-By: Claude Opus 5.5 Signed-off-by: masahiroid --- ...scanner.json => masahiroid-sbom-vulnerability-scanner.json} | 3 +-- tools/seculens.json | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) rename tools/{sbom_vulnerability_scanner.json => masahiroid-sbom-vulnerability-scanner.json} (96%) diff --git a/tools/sbom_vulnerability_scanner.json b/tools/masahiroid-sbom-vulnerability-scanner.json similarity index 96% rename from tools/sbom_vulnerability_scanner.json rename to tools/masahiroid-sbom-vulnerability-scanner.json index 27f5e27..5230b09 100644 --- a/tools/sbom_vulnerability_scanner.json +++ b/tools/masahiroid-sbom-vulnerability-scanner.json @@ -11,8 +11,7 @@ "OSI_APPROVED" ], "functions": [ - "ANALYSIS", - "AUTHOR" + "ANALYSIS" ], "supportedStandards": [ "CYCLONEDX", diff --git a/tools/seculens.json b/tools/seculens.json index 48c2a95..8e8c038 100644 --- a/tools/seculens.json +++ b/tools/seculens.json @@ -11,8 +11,7 @@ "OSI_APPROVED" ], "functions": [ - "ANALYSIS", - "AUTHOR" + "ANALYSIS" ], "supportedStandards": [ "CYCLONEDX", From d5f170843728aab326898b9ae8c98b9b13a022c8 Mon Sep 17 00:00:00 2001 From: masahiroid Date: Fri, 6 Nov 2026 23:36:33 +0900 Subject: [PATCH 3/5] fix: correct scanner analysis and SPDX output claims The scanner inspects source directories rather than BOM contents, so it does not claim SECURITY_VULNERABILITIES. SPDX is generated as tag-value; SPDX JSON is import-only. Co-Authored-By: Claude Opus 5.5 Signed-off-by: masahiroid --- tools/masahiroid-sbom-vulnerability-scanner.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tools/masahiroid-sbom-vulnerability-scanner.json b/tools/masahiroid-sbom-vulnerability-scanner.json index 5230b09..ce88245 100644 --- a/tools/masahiroid-sbom-vulnerability-scanner.json +++ b/tools/masahiroid-sbom-vulnerability-scanner.json @@ -19,11 +19,10 @@ "PACKAGE_URL" ], "name": "SBOM Vulnerability Scanner", - "description": "VS Code extension that generates and imports CycloneDX/SPDX JSON SBOMs, explores dependencies and licenses, scans known vulnerabilities using Trivy or npm audit, and exports HTML, JSON and Word reports.", + "description": "VS Code extension that generates CycloneDX JSON and SPDX tag-value SBOMs, imports CycloneDX/SPDX JSON SBOMs, explores dependencies and licenses, scans source directories for known vulnerabilities using Trivy or npm audit, and exports HTML, JSON and Word reports.", "repository_url": "https://github.com/masahiroid/sbom-vulnerability-scanner", "website_url": "https://marketplace.visualstudio.com/items?itemName=masahirocom.sbom-vulnerability-scanner", "analysis": [ - "SECURITY_VULNERABILITIES", "LICENSE_REPORTING" ], "packaging": [ From 802a30e7ad6a348c7cd60d52c3ac0b5b762c6e3b Mon Sep 17 00:00:00 2001 From: masahiroid Date: Fri, 6 Nov 2026 23:53:12 +0900 Subject: [PATCH 4/5] fix: describe SPDX output per generator Scanner 9.7.0 keeps SPDX JSON from Syft and Trivy; the built-in manifest reader writes tag-value. Co-Authored-By: Claude Opus 5.5 Signed-off-by: masahiroid --- tools/masahiroid-sbom-vulnerability-scanner.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/masahiroid-sbom-vulnerability-scanner.json b/tools/masahiroid-sbom-vulnerability-scanner.json index ce88245..dc0f50b 100644 --- a/tools/masahiroid-sbom-vulnerability-scanner.json +++ b/tools/masahiroid-sbom-vulnerability-scanner.json @@ -19,7 +19,7 @@ "PACKAGE_URL" ], "name": "SBOM Vulnerability Scanner", - "description": "VS Code extension that generates CycloneDX JSON and SPDX tag-value SBOMs, imports CycloneDX/SPDX JSON SBOMs, explores dependencies and licenses, scans source directories for known vulnerabilities using Trivy or npm audit, and exports HTML, JSON and Word reports.", + "description": "VS Code extension that generates CycloneDX JSON and SPDX SBOMs (SPDX JSON with Syft or Trivy, tag-value with its built-in npm manifest reader), imports CycloneDX/SPDX JSON SBOMs, explores dependencies and licenses, scans source directories for known vulnerabilities using Trivy or npm audit, and exports HTML, JSON and Word reports.", "repository_url": "https://github.com/masahiroid/sbom-vulnerability-scanner", "website_url": "https://marketplace.visualstudio.com/items?itemName=masahirocom.sbom-vulnerability-scanner", "analysis": [ From 540c8c925c7a497b5af5a0c986078c4979656294 Mon Sep 17 00:00:00 2001 From: masahiroid Date: Sat, 14 Nov 2026 08:29:22 +0900 Subject: [PATCH 5/5] Shorten SBOM Vulnerability Scanner description to fit 225-char limit Co-Authored-By: Claude Opus 5.5 --- tools/masahiroid-sbom-vulnerability-scanner.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/masahiroid-sbom-vulnerability-scanner.json b/tools/masahiroid-sbom-vulnerability-scanner.json index dc0f50b..8a54dbe 100644 --- a/tools/masahiroid-sbom-vulnerability-scanner.json +++ b/tools/masahiroid-sbom-vulnerability-scanner.json @@ -19,7 +19,7 @@ "PACKAGE_URL" ], "name": "SBOM Vulnerability Scanner", - "description": "VS Code extension that generates CycloneDX JSON and SPDX SBOMs (SPDX JSON with Syft or Trivy, tag-value with its built-in npm manifest reader), imports CycloneDX/SPDX JSON SBOMs, explores dependencies and licenses, scans source directories for known vulnerabilities using Trivy or npm audit, and exports HTML, JSON and Word reports.", + "description": "VS Code extension that generates CycloneDX and SPDX SBOMs, imports CycloneDX/SPDX JSON, explores dependencies and licenses, scans for vulnerabilities with Trivy or npm audit, and exports HTML, JSON and Word reports.", "repository_url": "https://github.com/masahiroid/sbom-vulnerability-scanner", "website_url": "https://marketplace.visualstudio.com/items?itemName=masahirocom.sbom-vulnerability-scanner", "analysis": [