agent-bom ingest

This Skill addresses a core pain point for enterprise operations and security teams in cloud asset inventory management: when standardized inventory JSON is already available from sources like AWS, Azure, GCP, Snowflake, CMDB, or endpoint collectors, how can you quickly perform data validation, local scanning, and compliance auditing without exposing cloud credentials to third-party tools? Traditional approaches often require granting tools direct access to cloud account keys, posing security risks, while manual JSON inspection is error-prone and inefficient.

Usage is straightforward. You simply prepare an inventory JSON file that conforms to the standard schema and invoke this skill via a natural language instruction. It will automatically execute the agent-bom mcp validate command to verify the JSON's field completeness, data types, and required fields. Upon successful validation, it proceeds to run agent-bom scan to generate scan results. You can specify the output format as JSON, SARIF, HTML, or Markdown for purposes like automation integration, CI gating, manual review, or archiving. The entire process requires no cloud credentials, and all computation is performed locally.

It is particularly well-suited for operations engineers, security auditors, and AI agent development teams that need to conduct regular cloud asset compliance audits. Especially for enterprises that already export inventory in JSON format via automated scripts or their CMDB, this skill can be directly embedded into AI Agent workflows, enabling a closed-loop process of "upload JSON → automatic validation → output audit report." For teams managing multi-cloud environments, this skill provides a unified data entry point, helping to avoid audit blind spots caused by platform differences.

It is recommended to use this tool uniformly within CI/CD pipelines or regular inspection tasks. Note that it primarily relies on the locally installed agent-bom tool (version 0.84.4 or higher) and a Python 3.11+ environment. The input JSON must strictly adhere to the field constraints defined in packaged inventory.schema.json; otherwise, validation will fail. Additionally, optional features like vulnerability lookups (OSV/GitHub Advisory) and pushing results to a control plane require network connectivity, but the tool runs locally by default.