What this skill does
Open security scanner for agentic infrastructure — agents, MCP, packages, blast radius, runtime, and trust for package CVEs (OSV, NVD, EPSS, KEV), container images, provenance, filesystems, and SBOMs. Use when: "check package", "scan image", "verify", "is this safe", "scan dependencies", "CVE lookup", "blast radius".
agent-bom scan is part of the Security & Privacy category — security and privacy skills that audit, vet, and protect your agent. You can install it on its own or alongside other security & privacy skills from the OpenClaw catalog.
How to install agent-bom scan
The easiest path is via the OpenClaw Easy desktop app — one click, no terminal required:
- Download OpenClaw Easy for macOS or Windows (free, one-click installer, ~30 seconds).
- Open the in-app Skills panel.
- Search for
agent-bom-scanand click Install. - The skill activates automatically when an incoming message matches its description.
Install from the command line
If you already run the OpenClaw CLI, add agent-bom scan with a single command:
openclaw skills add agent-bom-scan
This pulls agent-bom-scan from ClawHub and installs it into ~/.openclaw/skills/agent-bom-scan/. Restart the OpenClaw gateway afterwards so the new skill is discovered.
How to use agent-bom scan
Once installed, agent-bom scan activates on its own: when an incoming message on WhatsApp, Telegram, Slack, Discord, Feishu or Line matches the skill's description, your OpenClaw agent loads it and runs the workflow. You can also trigger it explicitly by describing the task in chat. No extra configuration is required after install.
Turning images into video
agent-bom scan works with images. Getting from there to something postable is a separate job: ViralMint — an open-source video pipeline — turns stills into motion — pans and transitions, synced captions, and a vertical export for short-form feeds.
It runs as an MCP server, so an OpenClaw agent can drive it from the same chat you already use: ask for a short, and the render comes back finished. See how to connect a video pipeline to your agent.
Manual install (advanced)
If you prefer manual installation:
- Click the Download .zip button above to grab
agent-bom-scan-0.99.0.zipdirectly from our S3 mirror. - Unzip into
~/.openclaw/skills/agent-bom-scan/(create the directory if it does not exist). - Restart OpenClaw Easy (or the OpenClaw CLI gateway) so the new skill is discovered.
Frequently asked questions
How do I install agent-bom scan?
Install agent-bom scan in the OpenClaw Easy desktop app by opening the Skills panel, searching for agent-bom-scan, and clicking Install. From a terminal you can run: openclaw skills add agent-bom-scan. Either way the skill is placed in ~/.openclaw/skills/agent-bom-scan/.
Is agent-bom scan free?
Yes. agent-bom scan is free and open-source, distributed under the Apache-2.0 license through ClawHub. No account or payment is required to download or run it.
What does agent-bom scan do?
Open security scanner for agentic infrastructure — agents, MCP, packages, blast radius, runtime, and trust for package CVEs (OSV, NVD, EPSS, KEV), container images, provenance, filesystems, and SBOMs.
Related: more security & privacy skills
If agent-bom scan looks useful, you may also want to check out other security & privacy skills in the OpenClaw catalog:
Browse the full OpenClaw skill catalog
This page covers just one skill. The OpenClaw skill hub has 10,000+ more — search, sort by downloads or stars, and install any of them in one click. There is also a curated awesome-openclaw-skills list grouped by use case.
Get OpenClaw Easy — Free
Install agent-bom scan and 10,000+ other OpenClaw skills in one click. Free, open-source, runs locally on macOS & Windows.
Free, open-source · Apache-2.0 · Works with Claude, ChatGPT, Gemini, or local Ollama models