Ida Reverse
sickn33/agentic-awesome-skills
Reverse engineer binaries with IDA Pro: decompilation, disassembly, data-flow tracking, cross-references, and IDA MCP automation for deep static analysis of PE/ELF/Mach-O targets.
MCP server security registry and trust assessment — look up servers in the 427+ server security metadata registry, run pre-install marketplace checks, batch fleet risk scoring, assess skill file…
Install Agent Bom Registry
$ npx skills add LeoYeAI/openclaw-master-skills --skill agent-bom-registry -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install LeoYeAI/openclaw-master-skills agent-bom-registry --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/LeoYeAI/openclaw-master-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/agent-bom/registry .claude/skills/agent-bom-registry && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "agent-bom-registry" agent skill from https://github.com/LeoYeAI/openclaw-master-skills/tree/main/skills/agent-bom/registry into .claude/skills/agent-bom-registry/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "agent-bom-registry", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/LeoYeAI/openclaw-master-skills/tree/main/skills/agent-bom/registryType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add LeoYeAI/openclaw-master-skills --skill agent-bom-registry -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install LeoYeAI/openclaw-master-skills agent-bom-registry --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/LeoYeAI/openclaw-master-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/agent-bom/registry .agents/skills/agent-bom-registry && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "agent-bom-registry" agent skill from https://github.com/LeoYeAI/openclaw-master-skills/tree/main/skills/agent-bom/registry into .agents/skills/agent-bom-registry/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "agent-bom-registry", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add LeoYeAI/openclaw-master-skills --skill agent-bom-registry -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install LeoYeAI/openclaw-master-skills agent-bom-registry --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/LeoYeAI/openclaw-master-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/agent-bom/registry .cursor/skills/agent-bom-registry && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "agent-bom-registry" agent skill from https://github.com/LeoYeAI/openclaw-master-skills/tree/main/skills/agent-bom/registry into .cursor/skills/agent-bom-registry/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "agent-bom-registry", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/LeoYeAI/openclaw-master-skills.git --path skills/agent-bom/registry--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add LeoYeAI/openclaw-master-skills --skill agent-bom-registry -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install LeoYeAI/openclaw-master-skills agent-bom-registry --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/LeoYeAI/openclaw-master-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/agent-bom/registry .gemini/skills/agent-bom-registry && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "agent-bom-registry" agent skill from https://github.com/LeoYeAI/openclaw-master-skills/tree/main/skills/agent-bom/registry into .gemini/skills/agent-bom-registry/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "agent-bom-registry", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install LeoYeAI/openclaw-master-skills agent-bom-registryInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add LeoYeAI/openclaw-master-skills --skill agent-bom-registry -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/LeoYeAI/openclaw-master-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/agent-bom/registry .github/skills/agent-bom-registry && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "agent-bom-registry" agent skill from https://github.com/LeoYeAI/openclaw-master-skills/tree/main/skills/agent-bom/registry into .github/skills/agent-bom-registry/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "agent-bom-registry", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add LeoYeAI/openclaw-master-skills --skill agent-bom-registry -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install LeoYeAI/openclaw-master-skills agent-bom-registry --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/LeoYeAI/openclaw-master-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/agent-bom/registry .opencode/skills/agent-bom-registry && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "agent-bom-registry" agent skill from https://github.com/LeoYeAI/openclaw-master-skills/tree/main/skills/agent-bom/registry into .opencode/skills/agent-bom-registry/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "agent-bom-registry", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
agent-bom-registry- GitHub stars
- 2.2k
- Token cost
- ~969 tokens
- SKILL.md length
- 140 words
- Files
- 1
- Skills in repo
- 1,235
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
MCP server security registry and trust assessment — look up servers in the 427+ server security metadata registry, run pre-install marketplace checks, batch fleet risk scoring, assess skill file…
- The user mentions MCP server trust
- SKILL.md covers Install, Tools (5), Example Workflows and MCP Resources, plus 2 more sections
- Calls pipx
- Registry lookup
What it does
Agent Bom Registry is an agent skill from LeoYeAI/openclaw-master-skills. MCP server security registry and trust assessment — look up servers in the 427+ server security metadata registry, run pre-install marketplace checks, batch fleet risk scoring, assess skill file trust, and run SAST code scans. Use when the user mentions MCP server trust, registry lookup, marketplace check, or skill trust assessment.
Its SKILL.md is about 970 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts. Compatibility notes: Requires Python 3.11+. Install via pipx or pip. Optional: Semgrep for SAST code scanning. No API keys or network access required (registry is bundled).
It sits in Security, covering Static analysis and SAST and MCP servers. It works with Model Context Protocol. The repository describes itself as: 🧠 Curated collection of 1209+ best OpenClaw skills — weekly updated by MyClaw.ai. The licence is Apache-2.0.
When your agent uses it
- The user mentions MCP server trust
- Registry lookup
- Marketplace check
- Skill trust assessment
Example prompts
- “/agent-bom-registry”
Requirements
- Python 3
- A credential in SNYK_TOKEN
- Compatibility (from SKILL.md): Requires Python 3.11+. Install via pipx or pip. Optional: Semgrep for SAST code scanning. No API keys or network access required (registry is bundled).
What it can do on your machine
Read from SKILL.md and the folder at commit e5199b5. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
pipx
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
github.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
Requires Python 3.11+. Install via pipx or pip. Optional: Semgrep for SAST code scanning. No API keys or network access required (registry is bundled).
From compatibility in the SKILL.md frontmatter.
Context cost
Agent Bom Registry loads about 969 tokens when it runs. Until then it costs about 88 tokens; SKILL.md has 140 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from LeoYeAI/openclaw-master-skills at commit e5199b5, republished under its Apache-2.0 licence (© LeoYeAI). 140 words, ~969 tokens.
Download SKILL.mdSave it as
.claude/skills/agent-bom-registry/SKILL.md (or your agent's skills folder).- name
- agent-bom-registry
- description
- MCP server security registry and trust assessment — look up servers in the 427+ server security metadata registry, run pre-install marketplace checks, batch fleet risk scoring, assess skill file trust, and run SAST code scans. Use when the user mentions MCP server trust, registry lookup, marketplace check, or skill trust assessment.
- compatibility
- Requires Python 3.11+. Install via pipx or pip. Optional: Semgrep for SAST code scanning. No API keys or network access required (registry is bundled).
- version
- 0.75.10
- license
- Apache-2.0
- metadata.author
- msaad00
- metadata.homepage
- https://github.com/msaad00/agent-bom
- metadata.source
- https://github.com/msaad00/agent-bom
- metadata.pypi
- https://pypi.org/project/agent-bom/
- metadata.scorecard
- https://securityscorecards.dev/viewer/?uri=github.com/msaad00/agent-bom
- metadata.tests
- 6040
agent-bom-registry — MCP Server Trust & Security Registry
Look up MCP servers in the 427+ server security metadata registry, assess skill file trust, and run pre-install marketplace checks.
Install
pipx install agent-bom
agent-bom registry-lookup brave-search
agent-bom marketplace-check @anthropic/server-filesystemTools (5)
| Tool | Description |
|---|---|
registry_lookup | Look up MCP server in 427+ server security metadata registry |
marketplace_check | Pre-install trust check with registry cross-reference |
fleet_scan | Batch registry lookup + risk scoring for MCP server inventories |
skill_trust | Assess skill file trust level (5-category analysis) |
code_scan | SAST scanning via Semgrep with CWE-based compliance mapping |
Example Workflows
# Look up a server in the registry
registry_lookup(server_name="brave-search")
# Pre-install trust check
marketplace_check(package="@modelcontextprotocol/server-filesystem")
# Assess trust of a skill file
skill_trust(skill_content="<paste SKILL.md content>")
# Batch risk scoring
fleet_scan(servers=["brave-search", "github", "slack"])MCP Resources
| Resource | Description |
|---|---|
registry://servers | Browse 427+ MCP server security metadata registry |
Privacy & Data Handling
Registry data is bundled in the package — lookups are in-memory string matches with zero network calls. Skill trust analysis parses content passed as a string argument (no file system access needed).
Verification
- Source: github.com/msaad00/agent-bom (Apache-2.0)
- 6,040+ tests with CodeQL + OpenSSF Scorecard
- No telemetry: Zero tracking, zero analytics
© LeoYeAI, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/agent-bom/registry of LeoYeAI/openclaw-master-skills.
Open the folder on GitHubat commit e5199b5
Compare with similar skills
Agent Bom Registry next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Agent Bom Registry this skillLeoYeAI/openclaw-master-skills | 2.2k | — | ~969 | Automated safety check: Pass | Apache-2.0 | |
| Ida Reversesickn33/agentic-awesome-skills | 47k | 1 repos | ~3.1k | Automated safety check: Pass | MIT | |
| Forensifyalexgreensh/repo-forensics | 190 | — | ~2.5k | Automated safety check: Notes | Custom licence | |
| Plugin Scanneriflytek/skillhub | 5.2k | 2 repos | ~1.1k | Automated safety check: Notes | Apache-2.0 | |
| Webcrypt MCPputervision/state-memory-mcp | 50 | — | ~847 | Automated safety check: Pass | MIT | |
| Security Passcyanheads/pubmed-mcp-server | 158 | — | ~6.4k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Forensify
alexgreensh/repo-forensics
Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.
Plugin Scanner
iflytek/skillhub
Scan AI agent skills, plugins, MCP servers, and agent tooling for prompt injection, unsafe commands, secret exposure, and supply-chain risks before installing or trusting them.
Webcrypt MCP
putervision/state-memory-mcp
Teaches the agent to use the WebCrypt MCP server for AES-256-GCM symmetric encryption, RSA-4096 hybrid encryption, key generation, digital signatures, hashing, and post-quantum cryptography.
Security Pass
cyanheads/pubmed-mcp-server
Review an MCP server for common security gaps: LLM-facing surfaces as injection vector (tools, resources, prompts, descriptions), scope blast radius, destructive ops without consent, upstream auth…
MCP Gateway Security
Hack23/cia
MCP gateway security patterns, token management, request validation, and audit logging for MCP communications
More from LeoYeAI/openclaw-master-skills
All 1,235 skills in this repoDevOps Pipeline Management
LeoYeAI/openclaw-master-skills
Manages pipelines on a DevOps quality and efficiency platform through its OpenAPI: list workspaces and templates, create, update, run and cancel pipelines, and read run records.
Feishu Document Collaboration
LeoYeAI/openclaw-master-skills
Patches OpenClaw's Feishu extension so an edited document triggers an isolated agent session that reads the doc and replies inline, turning it into a live chat space.
Files Memory System
LeoYeAI/openclaw-master-skills
Multi-context memory management system for OpenClaw agents with group-isolated storage, global shared memory, workspace organization, and group-specific skills isolation.
GEO-Claw AI Visibility Agent
LeoYeAI/openclaw-master-skills
Runs a brand's AI-search visibility work end to end: diagnosing how AI platforms represent it, repositioning it, producing AI-optimized content and monitoring ongoing mentions.
Google Workspace CLI
LeoYeAI/openclaw-master-skills
Installs and authenticates the gws CLI, then automates Gmail, Drive, Sheets, Calendar, Docs, Chat and Tasks with ready-made recipes, persona bundles and security audits.
HealthFit Health Advisors
LeoYeAI/openclaw-master-skills
Runs four advisor roles, a fitness coach, nutritionist, data analyst and TCM practitioner, to build a health profile and track workouts, diet and wellness over time.
Related
Works with
Categories
Questions about Agent Bom Registry
What does Agent Bom Registry do?
MCP server security registry and trust assessment — look up servers in the 427+ server security metadata registry, run pre-install marketplace checks, batch fleet risk scoring, assess skill file…. Agent Bom Registry is an agent skill from LeoYeAI/openclaw-master-skills. MCP server security registry and trust assessment — look up servers in the 427+ server security metadata registry, run pre-install marketplace checks, batch fleet risk scoring, assess skill file trust, and run SAST code scans.
When should I use Agent Bom Registry?
Agent Bom Registry fits situations like: the user mentions MCP server trust; registry lookup; marketplace check; skill trust assessment.
How do I install Agent Bom Registry in Claude Code?
Run `npx skills add LeoYeAI/openclaw-master-skills --skill agent-bom-registry -a claude-code`. Or copy the skill folder (skills/agent-bom/registry in LeoYeAI/openclaw-master-skills) into .claude/skills/agent-bom-registry in your project. Claude Code loads it when a task matches its description.
How do I install Agent Bom Registry in Codex?
Run `npx skills add LeoYeAI/openclaw-master-skills --skill agent-bom-registry -a codex`. Or copy the skill folder (skills/agent-bom/registry in LeoYeAI/openclaw-master-skills) into .agents/skills/agent-bom-registry in your project. Codex loads it when a task matches its description.
Can I use Agent Bom Registry in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add LeoYeAI/openclaw-master-skills --skill agent-bom-registry -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/agent-bom-registry, .gemini/skills/agent-bom-registry, .github/skills/agent-bom-registry and .opencode/skills/agent-bom-registry in your project.
What does Agent Bom Registry need to run?
Going by SKILL.md and its folder, Agent Bom Registry needs the command-line tools its instructions call (pipx). Our summary lists: Python 3; A credential in SNYK_TOKEN. Compatibility (from SKILL.md): Requires Python 3.11+. Install via pipx or pip. Optional: Semgrep for SAST code scanning. No API keys or network access required (registry is bundled)..
Does Agent Bom Registry access the network?
SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.
Is Agent Bom Registry safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Agent Bom Registry use?
Agent Bom Registry is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Agent Bom Registry use?
About 969 tokens (SKILL.md is roughly 3.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Agent Bom Registry?
Skills that share tags, products or a category with Agent Bom Registry: Ida Reverse (sickn33/agentic-awesome-skills, 47k stars), Forensify (alexgreensh/repo-forensics, 190 stars), Plugin Scanner (iflytek/skillhub, 5.2k stars) and Webcrypt MCP (putervision/state-memory-mcp, 50 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Agent Bom Registry?
LeoYeAI (a GitHub user) maintains it in LeoYeAI/openclaw-master-skills, which has 2,161 GitHub stars. The repository holds 1,235 skills in this directory. The repository was last updated on July 20, 2026.
Source: LeoYeAI/openclaw-master-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.