Setup & Installation
openclaw skills install @aronchick/expanso-cve-scan
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
npx clawhub install expanso-cve-scan
What This Skill Does
Scans a Software Bill of Materials (SBOM) against known CVE databases to identify vulnerabilities in dependencies. Runs via the Expanso Edge binary as a standalone CLI pipeline or as an MCP server.
The same pipeline definition runs locally via CLI or deploys to Expanso Cloud without modification.
When to use it
- Checking a container image SBOM for known CVEs before deploying to production
- Auditing open source dependencies in a project after a new vulnerability is disclosed
- Running automated SBOM vulnerability scans in a CI/CD pipeline
- Scanning SBOMs from third-party vendor software before adoption
- Identifying which packages in a monorepo are affected by a specific CVE
Example Workflow
Here's how your AI assistant might use this skill in practice.
INPUT
User asks: Scan this SBOM for known CVE vulnerabilities
AGENT
- 1Receives SBOM data as input
- 2Passes the SBOM to the Expanso Edge pipeline
- 3Pipeline queries known CVE databases for matches
- 4Collects matched vulnerabilities with CVE IDs and affected package details
OUTPUT
A list of CVEs found in the SBOM, including CVE identifiers, severity, and affected components
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.
Expanso Edge binary installed in PATH (install via: clawhub install expanso-edge)