Xpersona
Claim this agent
agentCLAWHUBUnverified

agent-bom ingest

Validate and ingest operator-pushed agent-bom inventory JSON from AWS, Azure, GCP, Snowflake, CMDB, or endpoint collectors. Use when a user has canonical inventory JSON and wants local findings, graph, policy, provenance, or auditor-ready exports without giving agent-bom direct cloud credentials. Skill: agent-bom ingest Owner: msaad00 Summary: Validate and ingest operator-pushed agent-bom inventory JSON from AWS, Azure, GCP, Snowflake, CMDB, or endpoint collectors. Use when a user has canonical inventory JSON and wants local findings, graph, policy, provenance, or auditor-ready exports without giving agent-bom direct cloud credentials. Tags: latest:0.108.3 Version history: v0.108.3 | 2026-10-08T22:19:15.016Z

OpenClaw
View on ClawHubHomepage

Rank

62

Safety

84

Downloads

4.4k

Updated

Oct 9, 2026

Version

0.108.3

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 4.4K downloads reported by the source. Last updated 10/9/2026.

Avoid when

  • Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor
Clawhubvendor · observed Oct 9, 2026
Protocol compatibility
OpenClawcompatibility · observed Oct 9, 2026
Adoption signal
4.4K downloadsadoption · observed Oct 9, 2026
Latest release
0.108.3release · observed Oct 8, 2026
Handshake status
UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s173dmtq1jwv3yxcgnmcxnn45583ey2y:agent-bom-ingest
  1. Setup complexity is classified as HIGH. You must provision dedicated cloud infrastructure or an isolated VM. Do not run this directly on your local workstation.
  2. Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-ingest/snapshot"

Documentation

CLAWHUB

70,006 characters of source documentation, loaded on request.

Extracted files

3 files captured from the source.

SKILL.md

---
name: agent-bom-ingest
description: >-
  Validate and ingest operator-pushed agent-bom inventory JSON from AWS, Azure,
  GCP, Snowflake, CMDB, or endpoint collectors. Use when a user has canonical
  inventory JSON and wants local findings, graph, policy, provenance, or
  auditor-ready exports without giving agent-bom direct cloud credentials.
version: 0.108.3
license: Apache-2.0
compatibility: >-
  Requires Python 3.11+ and agent-bom 0.84.4+. Inventory must conform to the
  packaged inventory.schema.json contract.
metadata:
  author: msaad00
  homepage: https://github.com/msaad00/agent-bom
  source: https://github.com/msaad00/agent-bom
  pypi: https://pypi.org/project/agent-bom/
  openclaw:
    requires:
      bins:
        - agent-bom
      env: []
      credentials: none
    credential_policy: "No cloud credentials are required. Optional control-plane push uses an operator-provided agent-bom API token; never ask users to paste that token into chat and never print it."
    optional_env:
      - AGENT_BOM_API_KEY
      - AGENT_BOM_PUSH_URL
    optional_bins: []
    emoji: "inbox"
    homepage: https://github.com/msaad00/agent-bom
    source: https://github.com/msaad00/agent-bom
    license: Apache-2.0
    os:
      - darwin
      - linux
      - windows
    credential_handling: "Inventory is schema-validated before it is trusted. Env var values, URL credentials, launch arguments, discovery_provenance, permissions_used, and security intelligence pass through the sanitizer/redaction contract before display/export."
    data_flow: "Operator-generated inventory JSON -> packaged inventory.schema.json validation -> local agent-bom scan/graph/export. Optional push to an operator-owned control plane goes only to the URL the operator provided."
    file_reads:
      - "operator-selected inventory JSON file"
      - "packaged agent_bom/data/inventory.schema.json"
    file_writes:
      - "operator-selected JSON/SARIF/HTML/Markdown export path"
    network_endpoints:
      - url: "operator-provided AGENT_BOM_PUSH_URL"
        purpose: "Optional push into the operator-owned agent-bom control plane"
        auth: true
        optional: true
      - url: "https://api.osv.dev/v1"
        purpose: "Optional package vulnerability lookup during local scan"
        auth: false
        optional: true
      - url: "https://api.github.com/advisories"
        purpose: "Optional GitHub Advisory enrichment during local scan"
        auth: false
        optional: true
    telemetry: false
    persistence: false
    privilege_escalation: false
    always: false
    autonomous_invocation: restricted
---

# agent-bom-ingest

Use this skill when the operator already produced canonical inventory JSON with
an operator-pull adapter, endpoint collector, CMDB export, or AI-agent workflow.
The default path is local validation plus local scan/export.

## Guardrails

- Validate inventory with the packaged schema before treating it as evidence.
- Require `discovery_provenance` and

_meta.json

{
  "ownerId": "kn7612j2dqa4vhvcpaygt6mcv981pft8",
  "slug": "agent-bom-ingest",
  "version": "0.108.3",
  "publishedAt": 1791497955016
}

skill-card.md

## Description:

Validates operator-provided agent inventory JSON and guides local scanning and export without requiring direct cloud credentials.

This skill is ready for commercial/non-commercial use.

## Publisher:

[msaad00](https://clawhub.ai/user/msaad00)

### License/Terms of Use:

MIT-0

## Use Case:

Developers and operators use this skill to validate inventory supplied by their own collectors, scan it locally for findings, and prepare exports for security or audit workflows.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: Selected inventory files could contain sensitive data or secrets.

Mitigation: Limit access to the intended inventory file, and verify redaction before including secrets or sharing exports.

Risk: Optional advisory lookups or control-plane push can transmit data over the network.

Mitigation: Enable network lookups only when appropriate; push only to an operator-approved destination with its designated authentication method.

## Reference(s):

- [ClawHub skill listing](https://clawhub.ai/msaad00/skills/agent-bom-ingest)
- [agent-bom project homepage (declared in skill metadata)](https://github.com/msaad00/agent-bom)
- [agent-bom package (declared in skill metadata)](https://pypi.org/project/agent-bom/)

## Skill Output:

**Output Type(s):** [Text, Markdown, Shell commands, Guidance]

**Output Format:** [Markdown with shell commands]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Guides validation and local scanning; the invoked tool can write operator-selected JSON, SARIF, HTML, or Markdown exports.]

## Skill Version(s):

0.108.3 (source: release metadata and skill frontmatter)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Related agents

Same protocol, similar job.

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW
Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW
Github ReposUpdated 6mo agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW
Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular

OPENCLAW

Machine-readable data

The same record, as JSON, for agents and crawlers.

{
  "facts": [
    {
      "factKey": "vendor",
      "category": "vendor",
      "label": "Vendor",
      "value": "Clawhub",
      "href": "https://clawhub.ai/msaad00/skills/agent-bom-ingest",
      "sourceUrl": "https://clawhub.ai/msaad00/skills/agent-bom-ingest",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T05:33:10.485Z",
      "isPublic": true
    },
    {
      "factKey": "protocols",
      "category": "compatibility",
      "label": "Protocol compatibility",
      "value": "OpenClaw",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-ingest/contract",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-ingest/contract",
      "sourceType": "contract",
      "confidence": "medium",
      "observedAt": "2026-10-09T05:33:10.485Z",
      "isPublic": true
    },
    {
      "factKey": "traction",
      "category": "adoption",
      "label": "Adoption signal",
      "value": "4.4K downloads",
      "href": "https://clawhub.ai/msaad00/agent-bom-ingest",
      "sourceUrl": "https://clawhub.ai/msaad00/agent-bom-ingest",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T05:33:10.485Z",
      "isPublic": true
    },
    {
      "factKey": "latest_release",
      "category": "release",
      "label": "Latest release",
      "value": "0.108.3",
      "href": "https://clawhub.ai/msaad00/agent-bom-ingest",
      "sourceUrl": "https://clawhub.ai/msaad00/agent-bom-ingest",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-10-08T22:19:15.016Z",
      "isPublic": true
    },
    {
      "factKey": "handshake_status",
      "category": "security",
      "label": "Handshake status",
      "value": "UNKNOWN",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-ingest/trust",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-ingest/trust",
      "sourceType": "trust",
      "confidence": "medium",
      "observedAt": null,
      "isPublic": true
    }
  ],
  "events": [
    {
      "eventType": "release",
      "title": "Release 0.108.3",
      "description": "Release v0.108.3",
      "href": "https://clawhub.ai/msaad00/agent-bom-ingest",
      "sourceUrl": "https://clawhub.ai/msaad00/agent-bom-ingest",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-10-08T22:19:15.016Z",
      "isPublic": true
    }
  ]
}

Record generated Oct 9, 2026.

Sponsored

Ads related to agent-bom ingest and adjacent AI workflows.