diff --git a/backend/utilities/plugin_runner/toolbox/lint_test.go b/backend/utilities/plugin_runner/toolbox/lint_test.go
index 44a6b43e..6008ca22 100644
--- a/backend/utilities/plugin_runner/toolbox/lint_test.go
+++ b/backend/utilities/plugin_runner/toolbox/lint_test.go
@@ -176,6 +176,50 @@ func TestValidInventory(t *testing.T) {
 	}
 }
 
+func TestValidSBOM(t *testing.T) {
+	actual := lint("sbom", []byte(`{
+		"success": true,
+		"truncated": false,
+		"details": [
+			[
+				{"sbom": "foo"}
+			],
+			[
+				{
+					"bom-ref": "pkg:golang/cloud.google.com/go/datastore@1.1.0",
+					"type": "gomod",
+					"name": "cloud.google.com/go/datastore",
+					"version": "1.1.0",
+					"licenses": [
+						{
+							"id": "Apache-2.0",
+							"name": "Apache-2.0"
+						}
+					]
+				}
+			]
+		],
+		"errors": ["failed to scan"]
+	}`))
+	if actual != nil {
+		t.Fatalf("expected no errors, got %v", actual)
+	}
+}
+
+func TestSBOMMissingValue(t *testing.T) {
+	actual := lint("sbom", []byte(`{
+		"success": true,
+		"truncated": false,
+		"details": [
+			[]
+		],
+		"errors": ["failed to scan"]
+	}`))
+	if !containsValidationError(actual, "/details", "minItems: got 1, want 2") {
+		t.Fatalf("expected required error, got %v", actual)
+	}
+}
+
 func TestUnknownType(t *testing.T) {
 	actual := lint("foo", []byte("{}"))
 	if actual == nil || !strings.Contains(actual.Error(), "unknown plugin type") {