Menu
Generate an OpenACA Agent BOM when the user asks for a bill of materials, Agent BOM, inventory export, or structured list of agent components.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Generate fast local OpenACA inventory from Claude Code endpoint or project configuration without running advisory lookups.
Run OpenACA scans from Claude Code when the user asks to scan agent components, check Claude Code configuration, inspect MCP servers/plugins/skills/hooks, or assess agent supply-chain risk.
Configure, check, or run explicit OpenACA Cloud sync for a Claude Code endpoint.
Guide agent supply-chain triage after Claude Code MCP, plugin, skill, hook, command, or settings changes.
Explain OpenACA findings, Agent BOM entries, scan output, severity, confidence, source provenance, and suggested next steps.
| name | bom |
| description | Generate an OpenACA Agent BOM when the user asks for a bill of materials, Agent BOM, inventory export, or structured list of agent components. |
| argument-hint | [endpoint|repo] [optional output path] |
| allowed-tools | ["Bash","Read"] |
Use this skill when the user asks for an Agent BOM, a structured inventory, a CycloneDX export, or a reusable snapshot of agent composition.
uvx --isolated --from openaca openaca bom endpoint --output openaca-agent-bom.json
uvx --isolated --from openaca openaca bom endpoint --project /path/to/project --output openaca-agent-bom.json
uvx --isolated --from openaca openaca bom repo --target /path/to/repo --output openaca-agent-bom.json
If uvx is unavailable but openaca is installed, use the same command
without the uvx prefix.
Describe the Agent BOM as composition data: what components exist, how they are related, and where they were observed. Keep findings separate: scan results and advisories reference BOM components, but the BOM itself is inventory.
When useful, suggest scanning the stored BOM with the current corpus for advisory matches:
uvx --isolated --from openaca openaca scan bom -v --input openaca-agent-bom.json
scan bom cannot surface posture findings — configuration-hygiene
rules (mutable install refs, MCP auto-approval, missing remote auth,
insecure transport) require live endpoint/project configuration that
isn't serialized into the CycloneDX BOM. For posture, run a fresh
endpoint or repo scan with --include-posture instead.
Do not paste the full BOM into chat unless the user asks. BOMs can contain local paths, URLs, component names, and source provenance. Prefer a concise summary and leave the file in the workspace.