# Agent Bom Scan Infra

> Scan infrastructure-as-code, cloud configurations, and find secrets. Use when: "check terraform", "scan kubernetes", "IaC", "find secrets", "scan dockerfile", "cloud security", "misconfigurations".

- Skill: `leoyeai-openclaw-master-skills/agent-bom-scan-infra` (Agent Skill)
- Install (CLI): `npx skillmds@latest add leoyeai-openclaw-master-skills/agent-bom-scan-infra`
- Raw SKILL.md: https://api.skillmd.com/api/skills/leoyeai-openclaw-master-skills/agent-bom-scan-infra/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: Apache-2.0
- Author: LeoYeAI (https://skillmd.com/u/leoyeai-openclaw-master-skills)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/leoyeai-openclaw-master-skills/agent-bom-scan-infra

---


# agent-bom-scan-infra — Infrastructure & Cloud Security Scanner

Scans infrastructure-as-code (Terraform, CloudFormation, Kubernetes), finds
secrets in config files, and runs cloud CIS benchmarks against AWS, Azure,
GCP, and Snowflake.

## Install

```bash
pipx install agent-bom
agent-bom iac infra/         # scan Terraform/CloudFormation/K8s
agent-bom cloud aws          # AWS CIS benchmark
agent-bom cloud azure        # Azure CIS benchmark
agent-bom cloud gcp          # GCP CIS benchmark
agent-bom secrets .          # find secrets in current directory
```

## When to Use

- "check terraform" / "scan terraform"
- "scan kubernetes" / "K8s security"
- "IaC" / "infrastructure as code"
- "find secrets" / "secret scanning"
- "scan dockerfile"
- "cloud security" / "CIS benchmark"
- "misconfigurations"

## Commands

```bash
# Scan IaC directory
agent-bom iac infra/

# Run cloud CIS benchmark
agent-bom cloud aws
agent-bom cloud azure
agent-bom cloud gcp
agent-bom cloud snowflake

# Find secrets in files
agent-bom secrets .
```

## Tools

| Tool | Description |
|------|-------------|
| `iac` | Scan Terraform, CloudFormation, Kubernetes YAML for misconfigurations |
| `cloud` | CIS benchmark checks (AWS, Azure v3.0, GCP v3.0, Snowflake) |
| `secrets` | Find secrets and credentials in files and directories |

## Examples

```
# Scan IaC directory for misconfigurations
iac(path="infra/")

# Run AWS CIS benchmark
cloud(provider="aws")

# Find secrets in project
secrets(path=".")
```

## Guardrails

- Confirm with the user before running cloud CIS benchmarks — these make live read-only API calls to AWS/Azure/GCP using the user's locally configured credentials.
- IaC and secrets scanning is purely local — no network calls.
- Do not modify any infrastructure files.
- Ask the user before scanning paths outside their home or project directory.
- Cloud credentials are used only to call the cloud provider's own APIs and are never transmitted elsewhere.