DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to scan a project's dependencies for CVEs and SBOM gaps with AI Security Tool

Generate an SBOM for a project and correlate its components with CVE data to get exportable findings.

Reverse engineering. Binary analysis steps can expose internals of third-party software, so only run them on code and binaries you are authorized to analyze.

Who it is forA DevSecOps engineer or application security reviewer who must check a project's third-party components before a release.

The problemDependency and CVE checks are spread across separate tools, and the results are hard to tie back to a specific SBOM.

The outcomeA console, JSON, CSV, HTML, or PDF report listing vulnerabilities enriched with remediation context for the target project.

What you need first

  • A Linux, macOS, or Windows machine with internet access to download the build
  • A web browser to open the Web UI at http://127.0.0.1:5577
  • Written authorization to scan or access every target system you plan to use
  • An API key for DeepSeek, OpenAI, or a custom LLM provider if you want the AI assistant or agents to call a model

Steps

  1. Install the Linux or macOS build with curl -o- https://raw.githubusercontent.com/ZeroDayEvil/ai-security-tool/main/scripts/one-line-web.sh | bash, or download the matching build from the Downloads table.
  2. Start the Web UI with ./build/bin/run-prod.sh and open http://127.0.0.1:5577 in your browser.
  3. In the Web UI, open the scanning workflow and point it at your project folder or asset. (inferred, check the README)
  4. Let the Binary and Dependency Analyzers generate or parse the SBOM and pass it to the Vulnerability Correlator.
  5. Export the findings as JSON, CSV, HTML, or PDF and review the remediation data for each item.

Prompt for your agent

Using the AI Security Tool repo at https://github.com/ZeroDayEvil/ai-security-tool, run its SBOM and CVE scanning workflow against <target-project-path> and export a JSON report. Expected output: a JSON file listing each component with its CVE matches and remediation context. Verify that the SBOM component count in the report matches the dependency count in the project's lock or manifest file.

Caveat. The README does not document the exact steps to select a scan target in the Web UI, so confirm that menu path in the running build before automating it.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page