Use this skill when the operator already produced canonical inventory JSON with
an operator-pull adapter, endpoint collector, CMDB export, or AI-agent workflow.
The default path is local validation plus local scan/export.
discovery_provenance and permissions_used where the source claimscloud/operator-pushed discovery.
discovery_provenance.source_type such as operator_pushed_inventory or skill_invoked_pull; do not infer it from
prose.
URL and auth method explicitly.
Validate first:
agent-bom mcp validate inventory.json
Scan locally:
agent-bom agents --inventory inventory.json --format json --output agent-bom-findings.json
Choose output by consumer:
Valid inventory preserves discovery_provenance, permissions_used,
cloud_origin, redaction state, package identity, server identity, tools, and
security intelligence. If the inventory is malformed or missing required trust
fields, stop and ask the operator to regenerate it rather than scanning a
best-effort summary.
共 7 个版本