AI runtime security monitoring — context graph analysis, runtime audit log correlation with CVE findings, and vulnerability analytics queries. Use when the u...

This SKILL.md reads like documentation for an external Python package rather than a self-contained skill. Before installing or enabling it: 1) Inspect the referenced PyPI/GitHub package (https://github.com/msaad00/agent-bom and PyPI page) to verify source code, release artifacts, and what env vars it actually uses (especially ClickHouse and kubectl integrations). 2) Confirm how the agent will obtain the package—automatic pip installs run arbitrary package code at install time; prefer installing into an isolated environment (pipx or a virtualenv) and reviewing package contents first. 3) If you plan to provide audit logs or a ClickHouse endpoint, make sure credentials are scoped and stored safely (do not expose cluster-wide kubeconfigs or broad DB credentials). 4) Ask the skill author (or check repo) for explicit env var names and a clear install manifest; if those are added (or the skill bundles its implementation), reassess. Given the current mismatch between claimed tools and the lack of bundled code/install spec, proceed cautiously.

Type: OpenClaw Skill Name: agent-bom-runtime Version: 0.82.3 The skill bundle contains metadata and documentation for 'agent-bom-runtime', a tool designed for AI runtime security monitoring and audit log correlation. The SKILL.md file describes legitimate security analysis functions (context graphs, CVE correlation) and explicitly outlines a privacy-conscious data flow with no telemetry or unauthorized network access. No malicious instructions, prompt injection attempts, or suspicious obfuscation were found in the provided documentation.