agent-bom scan

This Skill addresses security blind spots in AI Agent infrastructure. In practice, developers often need to check if packages their Agent depends on have known CVE vulnerabilities, if container images are secure, if the SBOM is complete, and perform blast radius analysis, but lack a unified tool. agent-bom-scan integrates multiple vulnerability databases including OSV, NVD, EPSS, and KEV, covering dimensions such as the Agent, MCP, runtime, and filesystem in a single scan.

Usage is straightforward: simply install via pip and input natural language instructions directly in the terminal or AI conversation, such as "Check if this package is safe" or "Scan the current image." It automatically fetches the latest vulnerability data and outputs a detailed report containing CVE IDs, severity levels, EPSS exploit probability, known exploited vulnerabilities (KEV), and more—no additional API key configuration required. It supports local-first scanning; all package names and CVE IDs are used solely to query public databases, ensuring no sensitive information is leaked.

It is ideal for teams or individuals needing to secure AI infrastructure, especially those who have deployed multiple Agents, MCP servers, or containerized applications and wish to continuously monitor dependency risks and runtime security, such as backend developers, DevOps engineers, and security testers. Zero credential requirements make the entry barrier extremely low, suitable for quick integration into CI/CD or development workflows.

It is recommended to use this tool for a full scan before each deployment or after dependency updates. Note that it primarily focuses on known vulnerability databases and blast radius analysis; it does not provide runtime dynamic detection or a custom rule engine. For in-depth compliance checks, other tools should be used. Additionally, container image scanning requires a local Docker environment or direct access to the image file.