---
title: "eczid-sbom-cra-readiness"
description: "CRA reporting obligations apply from 11 September 2026. Review whether a workspace holds the SBOM, VEX / CSAF, disclosure, provenance and release evidence needed to identify an affected component within the reporting win"
canonical: https://agentpluginsdirectory.com/plugins/eczid-sbom-cra-readiness
last-updated: 2026-10-21
---

# eczid-sbom-cra-readiness
CRA reporting obligations apply from 11 September 2026. Review whether a workspace holds the SBOM, VEX / CSAF, disclosure, provenance and release evidence needed to identify an affected component within the reporting window. Filename and path only. Free.
- Slug: eczid-sbom-cra-readiness
- Publisher: EcoCitizenz Ltd
- Repository: https://github.com/Ecocitizenz/eczid-agent-plugins
- Manifest: plugins/eczid-sbom-cra-readiness/plugin.json
- Version: 0.1.1
- License: MIT
- Category (editorial): security
- Skills: 1 (sbom-cra-evidence-review)
- MCP servers: 0
- Stars: 0
- Repository created: 2026-09-03
- Repository last pushed: 2026-09-03
- Publisher type: User
- Listing: https://agentpluginsdirectory.com/plugins/eczid-sbom-cra-readiness
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## What eczid-sbom-cra-readiness does, in the publisher's words

CRA reporting obligations apply from 11 September 2026. Review whether a workspace holds the SBOM, VEX / CSAF, disclosure, provenance and release evidence needed to identify an affected component within the reporting window. Filename and path only. Free.

No account, no sign-in, no licence key, no trial and no paywall. Every capability described below works in full as soon as you install it, in whatever host you run it in, for free.

This plugin is open source under the MIT licence: https://github.com/Ecocitizenz/eczid-agent-plugins

- Skill sbom-cra-evidence-review runs a portable, filename-and-path-only evidence review (scripts/review.mjs) and reports EVIDENCE OBSERVED / NOT OBSERVED, a deterministic Review Priority (LOW / NORMAL / ELEVATED / HIGH) with the reasons, why each class matters and what to review next, plus at most three contextual next actions.

From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/Ecocitizenz/eczid-agent-plugins/HEAD/plugins/eczid-sbom-cra-readiness/README.md

## Skills

- sbom-cra-evidence-review: Could your team identify an affected software component and its evidence chain within the reporting window? Runs a local, filename-and-path-only evidence review and reports EVIDENCE OBSERVED / NOT OBSERVED, a deterministic Review Priority with reasons, why each class matters and what to review next…

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.