agent-bom scan

This Skill addresses the challenge of discovering security blind spots in AI agent infrastructure. When building agents, MCP tools, dependency packages, and container images, developers often rely on traditional scanning tools but overlook novel risks such as the agent runtime's blast radius, chain of trust, and SBOM. It integrates multiple vulnerability databases including OSV, NVD, EPSS, and KEV, enabling a single scan of packages, containers, file systems, and runtime contexts to produce actionable security reports.

Usage is straightforward: simply run a single command in your project's root directory or trigger a scan via natural language instruction to your AI agent. It automatically identifies dependency files (e.g., package.json, requirements.txt), container image layers, MCP configurations, and SBOM manifests, cross-references them against vulnerability databases, and flags risks by severity. You can then use interactive dialogue to further investigate remediation advice for specific vulnerabilities.

It is well-suited for DevOps engineers, agent developers, and security testers who need to ensure agent security. Teams that have already deployed AI agents in production or built MCP toolchains can use it to quickly identify runtime risks; its blast radius assessment feature also aids in formulating isolation strategies.

We recommend using this tool for pre-deployment scanning whenever a new agent is deployed or a new dependency is introduced. Note that it primarily focuses on known vulnerabilities and configuration risks; zero-day vulnerabilities or business logic attacks still require complementary security measures. Scanning large projects may be time-consuming, so incremental execution within CI/CD pipelines is advised.