agent-bom scan
Open-source Agent Infrastructure Security Scanner
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom scan. It is used for: Open-source Agent Infrastructure Security Scanner Full Skill content: https://321skill.com/skills/agent-bom-scan-x-10/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the pain points of security scanning for Agentic infrastructure. In practical development, with the increasing number of components such as AI Agents, MCP servers, dependency packages, and container images, developers struggle to comprehensively check each component for CVE vulnerabilities, trust levels, and blast radius. Traditional tools also lack support for Agent-specific configuration scanning.
Usage is straightforward: simply install agent-bom, then use natural language instructions like "Scan this project for dependency vulnerabilities" or "Check container image security." It will automatically traverse project dependencies, container images, file systems, and SBOM manifests, query databases such as OSV, NVD, EPSS, and KEV, and finally generate an aggregated report including risk levels and remediation suggestions.
It is well-suited for development teams, operations engineers, and security auditors who need to ensure the security of Agent and AI applications. Particularly for teams already using Agent tools like MCP, Cursor, and Claude and wishing to automatically identify security risks before deployment, it can significantly reduce the cost of manual review.
It is recommended to integrate this tool into CI/CD pipelines or as part of daily development security checks. Note that it primarily relies on public vulnerability databases; internal network environments require proxy configuration or offline data sources. Scanning large projects may be time-consuming, so on-demand scanning rather than full scans is advised.
Key Features
Unlike Trivy, agent-bom is specifically designed for Agentic infrastructure, supporting scans of MCP server configuration files, Agent blast radius, and runtime trust chains, whereas Trivy focuses more on traditional container and operating system layer vulnerabilities.
Limitations
Requires Python 3.11+ environment. Scanning large projects or container images depends on network requests to public vulnerability databases; offline scenarios require pre-synchronized data.
FAQ
Is an API key required to use it?
No, basic operations require zero credentials. Optional environment variable configuration is only needed to increase API rate limits, but credentials are not automatically discovered or transmitted.
What types of scans are supported?
Supports package dependency (PyPI, npm, etc.), container image, SBOM, file system, MCP configuration file, Agent runtime trust scanning, and blast radius analysis.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-scan-x-10/raw/index.md to read the original Skill definition (Markdown format) for agent-bom scan, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-scan-x-10/raw/index.md