koda-ai-studio/agent-bom

v0.110.0Apache-2.0

Inventory and audit your AI estate from the shell: scan MCP servers, agents and packages for CVEs, supply-chain risk and exposed credentials; audit MCP configs and skills for injection and risky grants; check a package before you add it; plan fixes. Runs a pinned local CLI; read-only by default.

GitHub Open Website

skills

affected

Answer "am I affected by this CVE?" with agent-bom - look up a CVE, GHSA or OSV advisory (including CVEs only NVD has published) and report which agents, MCP servers, images or packages carry it with the version to patch to, which distro packages are possibly affected, and what was scanned. Use when the user names an advisory id or a vulnerability in the news and asks whether they are exposed.

License: Apache-2.0

Read SKILL.md at the source

Pinned to revision e42d0d569d9b, so it is the text this page describes rather than whatever the author pushed since.

Files

skills/affected/SKILL.md

Every link opens the file at its source, pinned to the revision this page describes.