the SBOM missed transitive dependencies - the agent scanned the SBOM and declared the image clean, but trivy on the...

TL;DR

Generate the SBOM from the thing you actually ship. A manifest-only SBOM misses transitives because nobody resolved them; a lockfile scan or a built-image scan includes the full resolved tree. Then keep a parity check: SBOM scan versus image scan should agree, and disagreement is a bug in the SBOM, not in the scanner.

the SBOM missed transitive dependencies - the agent scanned the SBOM and declared the image clean, but trivy on the image found 40 CVEs

Steps

1. Reproduce the gap. Scan the SBOM and scan the built image with the same scanner, then diff the package lists.

• Run: scan the SBOM file, then run the same scanner against the image, and compare.
• Expected: the image scan lists packages (mostly transitive) absent from the SBOM.

1. Find where the SBOM came from. If it was generated from a bare manifest (package.json, requirements.in) instead of a lockfile or image, that is the gap - manifests do not list transitives.

• Expected: the SBOM source is identified as manifest-based.

1. Regenerate from the lockfile, which contains the fully resolved tree including transitives.

• Run: generate the SBOM with the lockfile as input (for example, syft against package-lock.json or the pip freeze output).
• Expected: transitive packages now appear in the SBOM.

1. For container workflows, generate the SBOM from the built image instead. The image is the ground truth of what ships.

• Run: syft packages [REGISTRY]/[IMAGE]:[TAG] -o cyclonedx-json, writing the SBOM to a file.
• Expected: the SBOM matches what the image scanner sees.

1. Add a permanent parity check to the agent's pipeline: after every SBOM generation, compare its package count against an image or lockfile scan and alert on a large gap.

• Expected: future SBOM regressions get caught at generation time.

1. Re-triage the "clean" verdicts issued from the bad SBOMs. Anything declared clean from a transitive-missing SBOM needs a rescan.

• Expected: the previously missed CVEs enter the triage queue.

Use this when

• An SBOM scan says clean but an image or lockfile scan finds CVEs.
• Transitive dependencies are missing from generated SBOMs.
• The SBOM was built from a manifest rather than a lockfile or image.
• "No vulnerabilities found" verdicts do not survive a second scan method.

Not for this skill when

• Both scan methods agree the artifact is clean; the SBOM is fine.
• The disagreement is about versions or package names, not missing packages; that is a naming or matching problem.
• The image scan is the one that is wrong (stale base-image data); verify before blaming the SBOM.

Variant phrasings

• SBOM missing transitive dependencies
• trivy finds CVEs that SBOM scan missed
• incomplete SBOM from manifest file
• SBOM vs image scan results differ

Why it happens

Manifests declare direct dependencies; the transitive tree only exists after the package manager resolves it, and that resolved tree lives in the lockfile or the installed tree. An SBOM generator pointed at the manifest can only list what is declared, so every transitive-only CVE becomes invisible. The agent then scans an incomplete inventory and confidently reports clean.

Edge cases

• Lockfiles can drift from the built image if the image was built from a different commit; generate the SBOM in the same build that produces the image.
• Some ecosystems resolve transitives differently per platform; an SBOM built on one OS may miss platform-specific transitives.
• Vendored or manually installed packages appear in neither manifest nor lockfile; the image scan remains the backstop for those.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Sy9EA2kYiUAO0DKw9-brkQ