agent-bom scan
Agent Infrastructure Security Scanner for CVE and Dependency Risk Detection
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: agent-bom scan. It is used for: Agent Infrastructure Security Scanner for CVE and Dependency Risk Detection Full Skill content: https://321skill.com/skills/agent-bom-scan-x-9/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This Skill addresses the lack of security protection for Agent infrastructure. In practice, AI Agents, MCP servers, container images, and dependency packages may contain numerous known vulnerabilities (CVEs). Traditional security scanning tools often focus only on containers or code, overlooking Agent runtime configurations, MCP communication security, and blast radius impact. It provides a one-stop solution to scan package dependencies, container images, file systems, and SBOMs, while assessing runtime trust levels to prevent AI Agents from becoming attack vectors.
Usage is straightforward: simply install agent-bom via pip, run the agent-bom scan command with a target path or image name, and then use natural language instructions to inspect dependencies, scan container images, query CVE details, and evaluate blast radius. It supports local-first scanning, queries vulnerability databases like OSV, NVD, EPSS, and KEV without requiring external API keys, and automatically generates security reports.
It is well-suited for development teams and operations personnel who need to secure AI Agent systems, especially those already deploying MCP servers, using numerous open-source dependencies, or running containerized Agent services. It enables rapid identification of security risks in development, testing, and production environments, helping to prevent supply chain attacks or data breaches caused by vulnerabilities.
It is recommended to integrate this tool into CI/CD pipelines for automatic dependency and image scanning after each build. Note that it requires Python 3.11 or higher, and scanning large codebases may be slow, but incremental scanning and caching are supported. Additionally, optional configurations for Semgrep and kubectl can enhance static analysis capabilities, though core functionality requires no extra dependencies.
Key Features
Unlike traditional image scanners like Trivy, agent-bom is specifically designed for Agent infrastructure. It supports scanning MCP server configuration files and assessing Agent runtime trust and blast radius impact, whereas Trivy primarily focuses on container images and OS packages.
Limitations
Requires Python 3.11 or higher. Scanning large projects may be time-consuming, and vulnerability database updates (e.g., OSV/NVD queries) are unavailable in offline mode (requires internet connection).
FAQ
Is registration or an API key required to use it?
No, basic operations require no API keys and work directly after installation. However, optional environment variable settings can improve API rate limits.
Can it scan container images?
Yes, it natively supports container image scanning without external Docker scanners, analyzing image layers and dependency packages.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agent-bom-scan-x-9/raw/index.md to read the original Skill definition (Markdown format) for agent-bom scan, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agent-bom-scan-x-9/raw/index.md