Skip to content

koda-ai-studio/agent-bom

v0.110.0Apache-2.0

Inventory and audit your AI estate from the shell: scan MCP servers, agents and packages for CVEs, supply-chain risk and exposed credentials; audit MCP configs and skills for injection and risky grants; check a package before you add it; plan fixes. Runs a pinned local CLI; read-only by default.

GitHubOpen Website
skills

audit-skills

Audit Claude skills, plugins and agent instruction files (SKILL.md, CLAUDE.md, AGENTS.md, rules files) with agent-bom for prompt injection, credential exfiltration, remote code execution, dangerous tool grants and embedded secrets. Use when the user asks whether a skill or plugin is safe, before installing one, or to review agent instructions.

License
Apache-2.0
Read SKILL.md at the source

Pinned to revision e42d0d569d9b, so it is the text this page describes rather than whatever the author pushed since.

Files

Every link opens the file at its source, pinned to the revision this page describes.