feat: add agent-bom skill

[msaad00]

Summary

• Adds agent-bom — an AI supply chain security scanner for MCP servers and AI agents
• Installable via uvx agent-bom or pip install agent-bom
• Supports darwin + linux

What agent-bom does

• Auto-discovers MCP client configs (Claude Desktop, Cursor, VS Code, Windsurf, OpenClaw, etc.)
• Scans packages against OSV.dev for CVEs
• Enriches with NVD CVSS, EPSS probability, CISA KEV status
• Maps blast radius: CVE → package → server → agent → credentials/tools
• Generates SBOMs (CycloneDX 1.6, SPDX 3.0, SARIF 2.1.0)
• Enforces security policies and generates remediation plans

Links

• PyPI: https://pypi.org/project/agent-bom/
• GitHub: https://github.com/msaad00/agent-bom

[openclaw-barnacle]

Thanks for the pull request! This repository is read-only and is automatically synced from https://clawhub.ai, so we can’t accept changes here. Please make updates on the website instead.