What makes agent-bom discover gcp notable?

4.5K downloads. Trust evidence available

How should agent-bom discover gcp be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

agent-bom discover gcp

Discover GCP-hosted AI agent and MCP-relevant assets from the operator's environment, emit canonical agent-bom inventory JSON, and scan it without giving agent-bom long-lived GCP credentials. Use when a user asks to inventory Vertex AI, Cloud Run, Cloud Functions, GKE, or agentic GCP infrastructure as canonical inventory.

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

4.5k

Updated

Oct 9, 2026

Version

0.108.3

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 4.5K downloads reported by the source. Last updated 10/9/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 9, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 9, 2026
Adoption signal: 4.5K downloadsadoption · observed Oct 9, 2026
Latest release: 0.108.3release · observed Oct 8, 2026
Handshake status: UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s173dmtq1jwv3yxcgnmcxnn45583ey2y:agent-bom-discover-gcp

Install using `clawhub skill install s173dmtq1jwv3yxcgnmcxnn45583ey2y:agent-bom-discover-gcp` in an isolated environment before connecting it to live workloads.
No published capability contract is available yet, so validate auth and request/response behavior manually.
Review the upstream CLAWHUB listing at https://clawhub.ai/msaad00/agent-bom-discover-gcp before using production credentials.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-discover-gcp/snapshot"

Documentation

CLAWHUB

71,216 characters of source documentation, loaded on request.

Extracted files

3 files captured from the source.

SKILL.md

---
name: agent-bom-discover-gcp
description: >-
  Discover GCP-hosted AI agent and MCP-relevant assets from the operator's
  environment, emit canonical agent-bom inventory JSON, and scan it without
  giving agent-bom long-lived GCP credentials. Use when a user asks to
  inventory Vertex AI, Cloud Run, Cloud Functions, GKE, or agentic GCP
  infrastructure as canonical inventory.
version: 0.108.3
license: Apache-2.0
compatibility: >-
  Requires Python 3.11+, agent-bom installed from this repository or PyPI, and
  operator-controlled GCP read-only credentials from ADC, workload identity, or
  a scoped service account.
metadata:
  author: msaad00
  homepage: https://github.com/msaad00/agent-bom
  source: https://github.com/msaad00/agent-bom
  pypi: https://pypi.org/project/agent-bom/
  openclaw:
    requires:
      bins:
        - python
      env: []
      credentials: gcp-read-only
    credential_policy: "Use the operator's existing Application Default Credentials, workload identity, or short-lived service account credentials. Do not ask users to paste service account JSON into chat. Do not print credential values."
    optional_env:
      - GOOGLE_APPLICATION_CREDENTIALS
      - GOOGLE_CLOUD_PROJECT
      - CLOUDSDK_CONFIG
    optional_bins:
      - gcloud
    emoji: "search"
    homepage: https://github.com/msaad00/agent-bom
    source: https://github.com/msaad00/agent-bom
    license: Apache-2.0
    os:
      - darwin
      - linux
      - windows
    credential_handling: "Credentials stay in the operator environment. The skill invokes GCP SDK discovery locally and writes canonical inventory JSON with source_type=skill_invoked_pull. agent-bom receives sanitized inventory only when the operator explicitly scans or pushes that inventory."
    data_flow: "Operator GCP project -> read-only Google API calls -> canonical inventory JSON -> optional local agent-bom inventory scan. No agent-bom-hosted service is required. Credential-like values are redacted before persistence/export."
    file_reads:
      - "~/.config/gcloud/configurations/config_default"
      - "~/.config/gcloud/application_default_credentials.json"
      - "~/.config/gcloud/credentials.db"
      - "operator-selected service account JSON when GOOGLE_APPLICATION_CREDENTIALS is set"
    file_writes:
      - "operator-selected inventory JSON output path"
    network_endpoints:
      - url: "https://cloudresourcemanager.googleapis.com"
        purpose: "Project and resource inventory"
        auth: true
      - url: "https://aiplatform.googleapis.com"
        purpose: "Vertex AI inventory"
        auth: true
      - url: "https://run.googleapis.com"
        purpose: "Cloud Run inventory"
        auth: true
      - url: "https://cloudfunctions.googleapis.com"
        purpose: "Cloud Functions inventory"
        auth: true
      - url: "https://container.googleapis.com"
        purpose: "GKE inventory"
        auth: true
    telemetry: false
    persistence: false
    privilege_escalation

_meta.json

{
  "ownerId": "kn7612j2dqa4vhvcpaygt6mcv981pft8",
  "slug": "agent-bom-discover-gcp",
  "version": "0.108.3",
  "publishedAt": 1791497931440
}

skill-card.md

## Description:

Discovers GCP-hosted AI and workload assets and produces canonical agent-bom inventory JSON for optional local scanning.

This skill is ready for commercial/non-commercial use.

## Publisher:

[msaad00](https://clawhub.ai/user/msaad00)

### License/Terms of Use:

MIT-0

## Use Case:

Developers and cloud operators use this skill to inventory AI agents and related resources in approved GCP projects, then optionally scan that inventory for findings.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: GCP discovery uses the operator's authentication context.

Mitigation: Use approved projects and least-privilege read-only credentials; never paste or print credential values.

Risk: Generated inventory may contain sensitive resource metadata.

Mitigation: Choose the output path deliberately and review the inventory before sharing it.

## Reference(s):

- [agent-bom project homepage (skill metadata)](https://github.com/msaad00/agent-bom)
- [agent-bom PyPI package](https://pypi.org/project/agent-bom/)
- [ClawHub skill release](https://clawhub.ai/msaad00/skills/agent-bom-discover-gcp)

## Skill Output:

**Output Type(s):** [Shell commands, Files]

**Output Format:** [JSON inventory; optional JSON scan findings]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Inventory is saved to an operator-selected path; scanning occurs only on request.]

## Skill Version(s):

0.108.3 (source: release metadata and skill frontmatter)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Github ReposUpdated 6h agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW

Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular