Automate CVE scanning of packages and container images with SBOM generation.
npx skills add https://github.com/msaad00/agent-bom --skill agent-bom-scan
Please help me install this Agent Skill. Skill: agent-bom-scan Source: https://github.com/msaad00/agent-bom/tree/main/integrations/openclaw/scan Command: npx skills add https://github.com/msaad00/agent-bom --skill agent-bom-scan
Organizations face hidden vulnerabilities across software supply chains, including packages, container images, and provenance data. This Skill automates end-to-end scanning and verification to surface CVEs, validate provenance, and generate SBOMs to reduce risk and accelerate remediation.
Run the vulnerability scan across a set of packages and container images to identify CVEs and provenance issues.
High-intent search queries and answers about installing and using this skill.
You can automate end-to-end vulnerability scanning of software packages and container images to identify CVEs by integrating the scan directly into CI pipelines to detect unsafe dependencies before deployment.
Sigstore provenance verification validates the origin and integrity of software artifacts. It is integrated alongside SBOM generation to reduce risk and accelerate remediation across the software supply chain.
Yes, local-first scanning with zero external dependencies is supported. It applies to software supply chain scanning, SBOM generation, and risk assessment across local environments without requiring external calls.
EPSS, NVD, and OSV CVE data are integrated to provide a comprehensive risk assessment. This multi-source data integration helps surface vulnerabilities and prioritize remediation across local and CI environments.
The best way to generate an SBOM and verify supply chain security is to automate end-to-end scanning that surfaces CVEs, validates Sigstore provenance, and generates SBOMs to reduce risk across packages and images.
AgentSecOpsScan container images, dependencies, and IaC files for vulnerabilities and misconfigurations.
webrix-aiCorrelate CVE scan results with infrastructure to prioritize patching and create Jira tickets.
rocklambrosVerify Sigstore signatures and SLSA provenance for digest-pinned artifacts.
devendrapratapsinghAudit container images, Kubernetes configurations, cloud environments, and infrastructure as code for security vulnerabilities.
