ai-bom

80 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By cdxgen/cdxgen (GitHub) · security · 1,114 stars · scanned at commit 4a45539

Generates AI-BOM, MCP inventory, AI skill inventory, and AI authorship provenance documents with cdxgen, cataloging models, inference services, Hugging Face purls, MCP servers and their tools/prompts/resources, agent instruction files, and cdx:ai:codegen provenance signals, then audits them with AI-focused rule packs. Use when asked to inventory AI or ML usage, catalog MCP servers, audit agent instruction or skill files, assess AI supply-chain risk, or detect AI-generated code authorship.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. It runs automatically when the plugin is installed. Expected for a security skill.

Found in 13 places.

agent-plugin/skills/ai-bom/SKILL.md, line 25aibom /absolute/path/to/project
agent-plugin/skills/ai-bom/SKILL.md, line 31cdxgen -r --include-formulation \
agent-plugin/skills/ai-bom/SKILL.md, line 46aibom pkg:huggingface/deepseek-ai/DeepSeek-R1-Distill-Qwen-7B

Show 10 more

agent-plugin/skills/ai-bom/SKILL.md, line 64cdxgen --profile ml-tiny -o /absolute/path/to/bom.json /absolute/path/to/project
agent-plugin/skills/ai-bom/SKILL.md, line 84cdxgen -t mcp /absolute/path/to/project \
agent-plugin/skills/ai-bom/SKILL.md, line 112jq '.services[]' /absolute/path/to/bom.json
agent-plugin/skills/ai-bom/SKILL.md, line 155cdxgen -t js --bom-audit \
agent-plugin/skills/ai-bom/SKILL.md, line 164cdxgen -t js --exclude-type ai-skill --exclude-type mcp \
agent-plugin/skills/ai-bom/SKILL.md, line 182cdxgen -t ai-skill /absolute/path/to/project -o /absolute/path/to/bom.json \
agent-plugin/skills/ai-bom/SKILL.md, line 199cdxgen -t ai-provenance -o /absolute/path/to/bom.json /absolute/path/to/project
agent-plugin/skills/ai-bom/SKILL.md, line 209cdx-audit --bom /absolute/path/to/bom.json --direct-bom-audit
agent-plugin/hooks/hooks.json, line 9"command": "node",
agent-plugin/hooks/hooks.json, line 22"command": "node",

Downloads and installs other software

The author does not mention this. It runs automatically when the plugin is installed.

Found in 2 places.

agent-plugin/hooks/check-cdxgen.mjs, line 102"The cdxgen plugin needs the cdxgen CLI, which is not on PATH. Install it with `npm i -g @cdxgen/cdxgen`, or use the ghcr.io/cdxgen/cdxgen image.",
agent-plugin/hooks/check-cdxgen.mjs, line 113systemMessage: `cdxgen ${installed} is older than the cdxgen plugin (${pluginVersion}). Some skill instructions may use options it lacks. Update with \`npm i -g

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'ai-bom' ] || [ -L ~/.agents/skills/'ai-bom' ]; then echo 'A skill folder named ai-bom already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/cdxgen/cdxgen' "$d" && git -C "$d" checkout --quiet '4a45539a204af65f511000eeeec26f479cb48565' -- 'agent-plugin/skills/ai-bom' && mkdir -p ~/.agents/skills && cp -R "$d"/'agent-plugin/skills/ai-bom' ~/.agents/skills/'ai-bom' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'ai-bom' ~/.claude/skills/'ai-bom' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for cdxgen/cdxgen shows the score of its lowest-scoring skill.

SkillTrust badge for cdxgen/cdxgen

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/cdxgen/cdxgen.svg)](https://zalavijaysinh.github.io/skilltrust/repos/cdxgen/cdxgen/)

Score history

Date	Version	Score
2026-11-12	`4a45539`	80