My husband downloaded an obscure open source media server for the kids and I need a simple guide on conducting a software bill of materials to check if it contains malicious dependencies
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
My husband downloaded an obscure open source media server for the kids and I need a simple guide on conducting a software bill of materials to check if it contains malicious dependencies
1 real search · 1 real-search pass
official documentation generate SBOM Syft scan vulnerabilities Grype OSV Scanner malicious dependencies OpenSSF ScorecardGoogle ↗
OBSERVEDReason
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
ChatGPT real searches (1)
Classes come from the query-classifier (a local Laya model). 1 of 1 calls are low-confidence (under 50%) — hover a query in the table to see its confidence.
Searches and sources
ChatGPT1 real searches · gpt-6
official documentation generate SBOM Syft scan vulnerabilities Grype OSV Scanner malicious dependencies OpenSSF Scorecard Google ↗
- Syft official project and installation · github.com
- Grype official project and installation · github.com
- Supported Scan Targets · oss.anchore.com
- Projects · oss.anchore.com
- OSV-Scanner documentation · google.github.io
- OpenSSF Scorecard · scorecard.dev
- GuardDog project · github.com
- GitHub Security Advisories · github.com
- DevSecOpsGuideline/current-version/2-Process/2-3-Build/2-3-2-Software-Composition-Analysis/2-3-2-1-Software-Composition-Analysis.md at master · OWASP/DevSecOpsGuideline · github.com
- Home · security-insights.openssf.org