OpenParable
Skip to content
← Back to skills

Agent Bom Scan

DevOps & Security
agent-bom-scan

Agent Bom Scan is an Agent Skill for devops & security published in the LeoYeAI/openclaw-master-skills repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Open security platform for agentic infrastructure — checks packages for CVEs (OSV, NVD, EPSS, KEV), scans container images, verifies provenance, scans filesystems, and generates SBOMs. Use when: "check package", "scan image", "verify", "is this safe", "scan dependencies", "CVE lookup", "blast radius".

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/LeoYeAI/openclaw-master-skills/blob/HEAD/skills/agent-bom/scan/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/agent-bom-scan, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

agent-bom-scan — AI Supply Chain Vulnerability Scanner

Checks packages for CVEs, scans container images natively, verifies package provenance via Sigstore, scans filesystems, and generates SBOMs.

Install

pipx install agent-bom
agent-bom agents             # discover agents and scan dependencies
agent-bom check langchain==0.1.0  # check a specific package with version
agent-bom image nginx:1.25   # scan container image (native)
agent-bom fs .               # scan filesystem packages
agent-bom sbom .             # generate SBOM
agent-bom verify agent-bom   # verify Sigstore provenance
agent-bom where              # show all discovery paths

As an MCP Server

{
  "mcpServers": {
    "agent-bom": {
      "command": "uvx",
      "args": ["agent-bom", "mcp"]
    }
  }
}

When to Use

  • "check package" / "is this package safe"
  • "scan image" / "scan container"
  • "verify" / "check provenance"
  • "is this safe" / "CVE lookup"
  • "scan dependencies"
  • "blast radius"
  • "generate SBOM"

Tools (8)

ToolDescription
checkCheck a package for CVEs (OSV, NVD, EPSS, KEV)
scanFull discovery + vulnerability scan pipeline
blast_radiusMap CVE impact chain across agents, servers, credentials
remediatePrioritized remediation plan for vulnerabilities
verifyPackage integrity + SLSA provenance check
diffCompare two scan reports (new/resolved/persistent)
whereShow MCP client config discovery paths
inventoryList discovered agents, servers, packages

Examples

# Check a package before installing
check(package="langchain", version="0.1.0", ecosystem="pypi")

# Map blast radius of a CVE
blast_radius(cve_id="CVE-2024-21538")

# Full scan
scan()

# Verify package provenance
verify(package="agent-bom")

Guardrails

  • Show CVEs even when NVD analysis is pending or severity is unknown — a CVE ID is still a real finding.
  • Treat UNKNOWN severity as unresolved, not benign — it means data is not yet available.
  • Do not modify any files, install packages, or change system configuration.
  • Only public package names and CVE IDs leave the machine for vulnerability database lookups.
  • Ask before scanning paths outside the user's home directory.

Privacy & Data Handling

# Step 1: Install
pip install agent-bom

# Step 2: Review redaction logic BEFORE scanning
# sanitize_env_vars() replaces ALL env var values with ***REDACTED***
# BEFORE any config data is processed or stored:
# https://github.com/msaad00/agent-bom/blob/main/src/agent_bom/security.py#L159

# Step 3: Verify package provenance (Sigstore)
agent-bom verify agent-bom

# Step 4: Only then run scans
agent-bom agents

Verification