What makes agent-bom scan notable?

5K downloads. Trust evidence available

How should agent-bom scan be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

agent-bom scan

Check vulnerabilities in a specified package/version, repository, container image, or SBOM, or inspect a specified CVE. Discover local MCP clients only when the user explicitly requests that discovery. Ask for the target when a request such as "verify" or "is this safe" does not identify one. Skill: agent-bom scan Owner: msaad00 Summary: Check vulnerabilities in a specified package/version, repository, container image, or SBOM, or inspect a specified CVE. Discover local MCP clients only when the user explicitly requests that discovery. Ask for the target when a request such as "verify" or "is this safe" does not identify one. Tags: latest:0.108.3 Version history: v0.108.3 | 2026-10-08T22:17:30.509Z | user

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

5.0k

Updated

Oct 9, 2026

Version

0.108.3

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 5K downloads reported by the source. Last updated 10/9/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 9, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 9, 2026
Adoption signal: 5K downloadsadoption · observed Oct 9, 2026
Latest release: 0.108.3release · observed Oct 8, 2026
Handshake status: UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s173dmtq1jwv3yxcgnmcxnn45583ey2y:agent-bom-scan

Setup complexity is classified as HIGH. You must provision dedicated cloud infrastructure or an isolated VM. Do not run this directly on your local workstation.
Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-msaad00-agent-bom-scan/snapshot"

Documentation

CLAWHUB

121,960 characters of source documentation, loaded on request.

Extracted files

3 files captured from the source.

SKILL.md

---
name: agent-bom-scan
description: >-
  Check vulnerabilities in a specified package/version, repository, container
  image, or SBOM, or inspect a specified CVE. Discover local MCP clients only
  when the user explicitly requests that discovery. Ask for the target when
  a request such as "verify" or "is this safe" does not identify one.
version: 0.108.3
license: Apache-2.0
compatibility: >-
  Requires Python 3.11+. Install via pipx or pip. Native container image
  scanning — no external scanner required. No API keys required for basic
  operation.
metadata:
  author: msaad00
  homepage: https://github.com/msaad00/agent-bom
  source: https://github.com/msaad00/agent-bom
  pypi: https://pypi.org/project/agent-bom/
  scorecard: https://securityscorecards.dev/viewer/?uri=github.com/msaad00/agent-bom
  install:
    pipx: agent-bom
    pip: agent-bom
    docker: ghcr.io/msaad00/agent-bom:0.108.3
  openclaw:
    requires:
      bins: []
      env: []
      credentials: none
    credential_policy: "No credentials required for basic scanning. Do not discover or use cloud credentials through this skill. Use optional vulnerability-provider authentication only when configured for the requested scan."
    optional_env: []
    optional_bins:
      - semgrep
      - kubectl
    emoji: "\U0001F6E1"
    homepage: https://github.com/msaad00/agent-bom
    source: https://github.com/msaad00/agent-bom
    license: Apache-2.0
    os:
      - darwin
      - linux
      - windows
    credential_handling: "sanitize_env_vars() redacts credential-like and sensitive environment values before reporting; benign configuration values may remain in the in-memory model. Source: https://github.com/msaad00/agent-bom/blob/main/src/agent_bom/security.py"
    data_flow: "Online vulnerability lookups send package identifiers, versions and advisory IDs to providers. Confirm permission before querying private package identifiers. Image/repository inputs also contact the requested registry/host. Use offline mode when network queries are not authorized; report resulting coverage gaps. Do not upload configuration contents or scan reports through this skill."
    file_reads:
      # Possible discovery inputs, not permission to read every listed source.
      # Read only explicitly requested targets or authorized client discovery.
      # Claude Desktop
      - "~/Library/Application Support/Claude/claude_desktop_config.json"
      - "~/.config/Claude/claude_desktop_config.json"
      # Claude Code
      - "~/.claude/settings.json"
      - "~/.claude.json"
      # Cursor
      - "~/.cursor/mcp.json"
      - "~/Library/Application Support/Cursor/User/globalStorage/cursor.mcp/mcp.json"
      # Windsurf
      - "~/.windsurf/mcp.json"
      # Cline
      - "~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json"
      # VS Code Copilot
      - "~/Library/Application Support/Code/User/mcp.json"
      # Codex CLI
      - "~/.codex/config.to

_meta.json

{
  "ownerId": "kn7612j2dqa4vhvcpaygt6mcv981pft8",
  "slug": "agent-bom-scan",
  "version": "0.108.3",
  "publishedAt": 1791497850509
}

skill-card.md

## Description:

Checks vulnerabilities in specified packages, repositories, container images, and SBOMs, and looks up named advisories.

This skill is ready for commercial/non-commercial use.

## Publisher:

[msaad00](https://clawhub.ai/user/msaad00)

### License/Terms of Use:

MIT-0

## Use Case:

Developers and security teams use this skill to assess vulnerabilities in explicitly identified software or SBOMs, inspect advisories, and prepare scoped scan findings or reports.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: Online lookups may disclose package identifiers and versions to advisory providers.

Mitigation: Confirm permission before checking private identifiers, or use offline mode and note its coverage gaps.

Risk: Local MCP-client or home-directory discovery may inspect sensitive configuration.

Mitigation: Scan explicit targets without discovery; request local-client discovery only when expressly authorized.

## Reference(s):

- [ClawHub skill release](https://clawhub.ai/msaad00/skills/agent-bom-scan)
- [Project homepage](https://github.com/msaad00/agent-bom)
- [PyPI package](https://pypi.org/project/agent-bom/)
- [OpenSSF Scorecard](https://securityscorecards.dev/viewer/?uri=github.com/msaad00/agent-bom)

## Skill Output:

**Output Type(s):** [Analysis, Guidance, Shell commands, Configuration instructions]

**Output Format:** [Text or Markdown; JSON, SARIF, or CycloneDX/SPDX for requested reports]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Scoped to an authorized target; offline advisory coverage may be incomplete.]

## Skill Version(s):

0.108.3 (source: server release and skill frontmatter)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Github ReposUpdated 2h agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW

Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular