Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add msaad00/agent-bom --skill scangit clone --depth 1 https://github.com/msaad00/agent-bomWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/msaad00/agent-bom/scan)<a href="https://agentmods.dev/skills/msaad00/agent-bom/scan"><img src="https://agentmods.dev/badge/skills/msaad00/agent-bom/scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/msaad00/agent-bom/scan"><img src="https://agentmods.dev/badge/skills/msaad00/agent-bom/scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 8 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Agent Snooping · line 51 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- high Agent Snooping · line 63 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- high Agent Snooping · line 65 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- high Agent Snooping · line 69 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- medium Data Exfiltration · line 101 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 107 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 110 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Privilege Escalation · line 215 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.02795 |
| Opus 5.5 | $0.00026 | $0.01118 |
| Sonnet 5.5 | $0.00013 | $0.00559 |
| Haiku 4.5 | $0.00007 | $0.00280 |
Grade B, and why
agent-bom-scan scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- "~/.claude/settings.json" How it starts
The opening of the file, as written. The whole thing — 266 lines — stays where its author put it; the contents beside it link to each section on GitHub.
agent-bom-scan — AI Supply Chain Vulnerability Scanner
Checks packages for CVEs, scans container images natively, verifies package provenance via Sigstore, scans filesystems, and generates SBOMs.
Install
pipx install agent-bom
agent-bom check langchain==0.1.0 # check a specific package with version
agent-bom scan --project . --no-discover # scan the requested project
agent-bom scan --image nginx:1.25 --no-discover # scan the requested image
agent-bom scan --sbom sbom.json --no-discover # scan a supplied SBOM
agent-bom scan --project . --no-discover -f cyclonedx -o sbom.json # requested output
agent-bom verify agent-bom # verify Sigstore provenance
Choose the Target First
Use the narrowest input that satisfies the request. If the package/version, repository, image or SBOM is missing, ask for it. Do not interpret a generic "verify" or "is this safe" as permission to scan the host.
For explicit CLI targets, pass --no-discover; for the MCP scan tool, pass
no_discover=True. An invalid, empty or unreadable target is a collection gap,
not permission to fall back to home-directory or MCP-client discovery. Report
the gap and ask for a valid target.
Home-directory configuration and MCP-client discovery require an explicit user
request for those sources. The file_reads list discloses possible inputs; it
does not authorize reading them. Do not use discovered cloud credentials.
Cloud inventory requires the separately authorized cloud discovery skill.
Scans can write local state and vulnerability caches. Write reports or SBOMs only to requested output paths. Offline scans may have incomplete advisory coverage; preserve that qualification in the result.
As an MCP Server
{
"mcpServers": {
"agent-bom": {
"command": "uvx",
"args": ["agent-bom", "mcp", "server"]
}
}
}
When to Use
- Check a named package and version for vulnerabilities.
- Scan a specified image, repository or SBOM.
- Look up a named CVE or advisory.
- Generate an SBOM for a specified project.
- Discover local MCP clients when the user explicitly requests that scope.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed 26f9d40f1c13
- 9d ago Changed 71a76f045046
- 10d ago Changed 40fef0604b23
- 11d ago Changed · +23 lines · -23 tokens per session scan A → B 9fc2a400d892
- 14d ago Changed 1871f334eb87
- 16d ago Changed 309a8fcb4418
- 17d ago Changed aa0e09db1035
- 21d ago Changed a98d0d627ff8
- 24d ago Changed 56711758d97d
- 1mo ago First seen · 243 lines · 89 tokens per session scan A 7f66ee45f978
agent-bom-scan is a skill published in the GitHub repository msaad00/agent-bom (31 stars, last pushed 8d ago), licensed Apache-2.0. It adds 66 tokens to every session and 2,795 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
implementing-aqua-security-for-container-scanning
Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries.
performing-container-security-scanning-with-trivy
Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.
implementing-aqua-security-for-container-scanning
Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries.
scanning-container-images-with-grype
Scan container images for known vulnerabilities using Anchore Grype with SBOM-based matching and configurable severity thresholds.
red-teaming-llms-with-garak
Run NVIDIA garak probe suites against an LLM endpoint to test for jailbreaks, prompt injection, data leakage, and toxic generation, then interpret the hit-rate report for triage and reporting.
sbom-analysis
Analyzes Software Bills of Materials (SBOMs) for completeness against NTIA minimum elements, interprets VEX status documents, performs transitive dependency risk analysis, and detects license conflicts. Supports CycloneDX 1.5 and SPDX 2.3 formats with CSAF-based VEX correlation. Auto-invoked when SBOM files are…