agent-bom scan
Agent Infrastructure Security Scanner with support for CVE, SBOM, and container images
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom scan. It is used for: Agent Infrastructure Security Scanner with support for CVE, SBOM, and container images Full Skill content: https://321skill.com/skills/agent-bom-scan-x-7/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the fragmentation of security scanning in agent infrastructure. In practical development, when building agentic applications, developers often need to conduct security reviews across multiple layers such as agent dependencies, MCP configurations, container images, and SBOMs, but lack a unified tool. It can uniformly scan agent dependencies, MCP configurations, package vulnerabilities (CVEs), container images, and more, while assessing blast radius and trustworthiness to help developers quickly identify security risks.
Usage is straightforward: after installation via pip, it can be invoked via natural language commands in the terminal or within AI coding assistants. For example, saying "Scan this project's dependencies for security vulnerabilities" or "Check this container image for CVEs" will trigger automatic analysis and output results. It supports local-first scanning, requiring no additional API keys, though environment variables (e.g., API keys for OSV, NVD) can be configured to improve rate limits.
It is well-suited for operations engineers, test engineers, and backend developers, especially teams that frequently deploy containers, manage agent dependencies, or audit project security. For developers using AI coding assistants like Claude or Cursor, it can be installed as a Skill for direct invocation, enabling on-demand security scanning during development without switching to standalone tools.
It is recommended to integrate this tool into CI/CD pipelines as a pre-deployment security scanning step. Note that it primarily scans public package names and CVE IDs against vulnerability databases and does not upload local configurations or scan results, ensuring data security. However, Python 3.11+ is required, and advanced features (such as semantic analysis) may require optional tools like semgrep or kubectl.
Key Features
Unlike traditional container scanning tools such as Trivy, agent-bom scan is specifically designed for agentic infrastructure. It supports scanning agent-specific assets like MCP configurations, blast radius, and provenance, and can run with zero credentials, requiring no external scanner dependencies.
Limitations
Requires Python 3.11+. Basic scanning does not need an API key, but configuring environment variables is recommended for high-volume scanning to improve rate limits. Container image scanning does not require additional Docker installation.
FAQ
Do I need to install Docker to scan container images?
No, it has built-in native container image scanning capabilities and does not require an external scanner.
Which package managers are supported?
It supports most common package formats (e.g., pip, npm, maven, go) and matches CVEs against databases like OSV, NVD, and EPSS, while generating SBOMs.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-scan-x-7/raw/index.md to read the original Skill definition (Markdown format) for agent-bom scan, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-scan-x-7/raw/index.md