affected
85 / 100 · Low risk
Fine to try.
Answer "am I affected by this CVE?" with agent-bom - look up a CVE, GHSA or OSV advisory (including CVEs only NVD has published) and report which agents, MCP servers, images or packages carry it with the version to patch to, which distro packages are possibly affected, and what was scanned. Use when the user names an advisory id or a vulnerability in the news and asks whether they are exposed.
What this skill can do
Downloads and installs other software
Other copies in this repository
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'affected' ] || [ -L ~/.agents/skills/'affected' ]; then echo 'A skill folder named affected already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/koda-ai-studio/agent-bom' "$d" && git -C "$d" checkout --quiet 'dcd0f62fa69f34541ab70d52ab7acd1a10847a6d' -- 'integrations/codex/skills/affected' && mkdir -p ~/.agents/skills && cp -R "$d"/'integrations/codex/skills/affected' ~/.agents/skills/'affected' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'affected' ~/.claude/skills/'affected' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
[](https://zalavijaysinh.github.io/skilltrust/repos/koda-ai-studio/agent-bom/)
Score history
| Date | Version | Score |
|---|---|---|
| 2026-11-13 | dcd0f62 | 85 |
| 2026-11-09 | 308f543 | 85 |
| 2026-11-07 | 823e5f1 | 85 |