Vulnerability Assessment Agent

Regular, scoped vulnerability findings with no out-of-scope scanning.

A ready-to-build governance package for Cybersecurity / IT Operations. Your runtime enforces it; Agent Bob does not run the agent.

Build this package Have it set up for you

Purpose

You want in-scope systems assessed for vulnerabilities on a regular schedule. This agent checks only the assets in the confirmed scope and writes up the findings. A security lead confirms the scope before each assessment begins.

It will

Read-only scanning of in-scope assets only — no exploit execution, no write access, no scanning of out-of-scope systems

It won't

Actively exploit vulnerabilities, scan assets outside the approved scope, access production credential stores

It asks a person first

Escalate to security lead on discovery of any actively exploited (CISA KEV-listed) vulnerability
Security lead must confirm scan scope before any scan begins

Tools

Web research
Document writing

Web research: Look things up online.
Document writing: Create or edit Word / Google Docs / Notion pages.

✋ You approve once at the start of each run

Budget defaults

Per task: $0.50
Per month: $40
Actions a day: 20

The runtime pauses the agent at a limit. You can change every number in the builder.

Memory and autonomy

Session only. Nothing is kept once the session ends.

ClawMaven policy: per-engagement only — scan results and asset data purged on completion

Acts within limits: low-risk steps on its own, everything gated still stops for a person.

What you get

The 8-file governed package your runtime loads and enforces. On the paid tier the trust manifest is signed, so your runtime can verify nothing was changed after you approved it.

HANDOFF.md What your runtime has to enforce, file by file
agent-blueprint.json The agent's purpose, tools and settings
policy.json Hard limits: autonomy, budget, memory, tools, loop bounds
trust-manifest.json The integrity manifest your runtime can verify
routing.rules.json Which tools need approval before use
run-report-template.json What every run reports back
approval-gates.md The moments that must pause for a person
deployment-checklist.md What to check before it goes live

This is a governance specification, not a running agent. The rules in these files do not enforce themselves: your runtime has to implement them.

Start from this package

Bob pre-fills the builder with it and drafts the rest. You confirm every step.

Build this package Have it set up for you