agent-bom-scan@0.110.0

VERIFIED

Publisher claims: "Check vulnerabilities in a specified package/version, repository, container image, or SBOM, or inspect a specified CVE. Discover local MCP clients only when the user explicitly requests that discovery. Ask for the target when a request such as "verify" or "is this safe" does not identify one." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher msaad00 · joined 1 days agoInstalls 5,322Last detonated 29 h ago

$npx skills add agent-bom-scan

Report an issue

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

MEDIUM

File type combined with upload actionSKILL.md:220 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actionSKILL.md:135 · File type combined with upload action — agent may exfiltrate local data files

AST07