agent-bom scan
AI Infrastructure Security Scanner, covering packages, container images, and SBOMs
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom scan. It is used for: AI Infrastructure Security Scanner, covering packages, container images, and SBOMs Full Skill content: https://321skill.com/skills/agent-bom-scan-x-11/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the pain points of security scanning for Agent infrastructure. In real-world development, engineers often need to check dependencies, container images, SBOMs, and MCP runtimes for known vulnerabilities. However, manually querying multiple databases (OSV, NVD, EPSS, KEV, etc.) is inefficient and prone to oversight. agent-bom scan consolidates all of this into a single command, additionally providing blast radius analysis and trust scoring to help teams quickly identify risks.
Usage is straightforward: simply install agent-bom via pip or pipx, then trigger a scan using natural language instructions (e.g., "check if this package is safe," "scan the current Docker image," "validate this SBOM file"). It automatically parses project dependencies, container image layers, or SBOM data, queries multiple vulnerability databases, and returns a detailed list of CVEs, risk levels, blast radius assessments, and trust scores. All scans are performed locally by default, sending only public package names and CVE IDs to external databases.
It is ideal for teams needing to ensure Agent security, especially those building MCP servers, agent applications, or containerized deployments. DevOps engineers can integrate it into CI/CD pipelines for automated security gating, QA engineers can quickly validate third-party dependency compliance, and backend developers can identify potential vulnerabilities during the development phase.
We recommend using this tool uniformly within CI/CD workflows and configuring optional environment variables (e.g., GitHub Token) to improve API rate limits. Note that it requires Python 3.11+, and container image scanning depends on a local OCI runtime (Docker/containerd). However, basic operations require no API keys and are fully usable offline.
Key Features
Unlike general-purpose container scanners like Trivy and Grype, agent-bom is specifically designed for Agentic infrastructure (MCP, Agent runtimes, SBOMs) and includes built-in blast radius analysis and trust assessment, rather than just outputting a list of CVEs.
Limitations
Requires Python 3.11+; container image scanning depends on a local OCI runtime; high-frequency queries may be subject to external database rate limits (can be mitigated by setting environment variables).
FAQ
Do I need Docker installed to use it?
No, but scanning container images requires a local Docker or containerd runtime. Basic package scanning and SBOM analysis do not require Docker.
Which vulnerability databases are supported?
Supports OSV, NVD, EPSS, KEV, and GitHub Advisories; queries are performed without additional configuration.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-scan-x-11/raw/index.md to read the original Skill definition (Markdown format) for agent-bom scan, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-scan-x-11/raw/index.md