Scan agent dependencies, packages, images, and filesystems for CVEs, provenance issues, and blast radius.
by Agent Bom73 installs
Documents
agent-bom compliance
Evaluate AI scan results against security frameworks, enforce policies, and export CycloneDX or SPDX SBOMs.
What it does
Evaluate in-memory AI infrastructure scan results against 15 frameworks, including OWASP, NIST, EU AI Act, ISO 27001, SOC 2, and CMMC. Apply custom policy rules, run AISVS v1.0 or optional cloud CIS checks, and produce compliance results plus CycloneDX or SPDX SBOMs.
When to use it
- Multi-framework compliance reporting
- Custom policy enforcement on scan findings
- CycloneDX or SPDX SBOM generation
- AISVS and cloud CIS benchmark checks
The skill document
agent-bom-compliance — AI Compliance & Policy Engine
Evaluate AI infrastructure scan results against 14 security and regulatory frameworks. Enforce policy-as-code rules. Generate SBOMs in standard formats. Run AISVS v1.0 and CIS benchmark checks.
Install
pipx install agent-bom
agent-bom scan --compliance --compliance-export nist-ai-rmf
agent-bom scan -f cyclonedx -o sbom.json
When to Use
- "compliance report" / "run compliance"
- "NIST" / "NIST AI RMF" / "NIST CSF" / "NIST 800-53"
- "SOC 2" / "SOC2"
- "ISO 27001"
- "OWASP" / "OWASP LLM Top 10" / "OWASP Agentic Top 10"
- "EU AI Act"
- "AISVS" / "AI Security Verification Standard"
- "CMMC" / "FedRAMP"
- "generate SBOM" / "CycloneDX" / "SPDX"
- "policy check" / "policy enforcement"
Tools (5)
| Tool | Description |
|---|---|
compliance | OWASP LLM/Agentic Top 10, EU AI Act, MITRE ATLAS, NIST AI RMF |
policy_check | Evaluate results against custom security policy (17 conditions) |
cis_benchmark | Run CIS benchmark checks against cloud accounts |
generate_sbom | Generate SBOM (CycloneDX or SPDX format) |
aisvs_benchmark | OWASP AISVS v1.0 compliance — 9 AI security checks |
Supported Frameworks (15)
- OWASP LLM Top 10 (2025) — prompt injection, supply chain, data leakage
- OWASP MCP Top 10 — MCP-specific security risks
- OWASP Agentic Top 10 — tool poisoning, rug pulls, credential theft
- MITRE ATLAS — adversarial ML threat framework
- MITRE ATT&CK Enterprise — adversary techniques tagged via CWE → CAPEC → ATT&CK on every blast-radius finding
- NIST AI RMF — govern, map, measure, manage lifecycle
- NIST CSF 2.0 — identify, protect, detect, respond, recover
- NIST 800-53 Rev 5 — federal security controls (CM-8, RA-5, SI-2, SR-3)
- FedRAMP Moderate — derived from NIST 800-53 controls
- EU AI Act — risk classification, transparency, SBOM requirements
- ISO 27001:2022 — information security controls (Annex A)
- SOC 2 — Trust Services Criteria
- CIS Controls v8 — implementation groups IG1/IG2/IG3
- CMMC 2.0 — cybersecurity maturity model (Level 1-3)
- PCI DSS v4.0 — payment-card data security requirements
OWASP AISVS v1.0 ships as a benchmark surface alongside the tag-mapped frameworks (9 verification checks).
Examples
# Run compliance check against multiple frameworks
compliance(frameworks=["owasp_llm", "eu_ai_act", "nist_ai_rmf"])
# Enforce custom policy
policy_check(policy={"max_critical": 0, "max_high": 5})
# Generate SBOM
generate_sbom(format="cyclonedx")
# Run AISVS v1.0 compliance
aisvs_benchmark()
# Run AWS CIS benchmark
cis_benchmark(provider="aws")
Privacy & Data Handling
OWASP, NIST, EU AI Act, MITRE ATLAS, AISVS, SBOM generation, and policy checks run entirely locally on scan data already in memory. No network calls, no credentials needed for these features.
CIS benchmark checks (optional, user-initiated) call cloud provider APIs
using your locally configured credentials. These are read-only API calls to
AWS, Azure, GCP, or Snowflake. You must explicitly run cis_benchmark(provider=...)
and confirm before any cloud API calls are made.
Verification
- Source: github.com/msaad00/agent-bom (Apache-2.0)
- 7,100+ tests with CodeQL + OpenSSF Scorecard
- No telemetry: Zero tracking, zero analytics
Questions people ask
- Which compliance frameworks are supported?
- Coverage includes OWASP LLM, MCP, and Agentic Top 10; MITRE ATLAS and ATT&CK; NIST AI RMF, CSF 2.0, and 800-53; FedRAMP, EU AI Act, ISO 27001, SOC 2, CIS Controls, CMMC, and PCI DSS. AISVS v1.0 is provided as a separate nine-check benchmark surface.
- Do compliance checks send scan data or require credentials?
- OWASP, NIST, EU AI Act, MITRE ATLAS, AISVS, SBOM generation, and policy checks run locally on scan data already in memory, with no network calls or credentials. The project also states that it has no telemetry or analytics.
- When are cloud APIs accessed?
- Only an explicitly initiated CIS benchmark calls AWS, Azure, GCP, or Snowflake APIs. It requires confirmation, uses locally configured credentials, and makes read-only calls.
Related skills
Correlate runtime activity with CVEs and analyze context graphs, vulnerability trends, and security posture.
72 installs
Draft legal documents, policies, memos, and compliance checklists from detailed natural-language requirements.
76 installs2 stars
Check MCP servers and skill files for registry risk, provenance, trust, and code findings.
72 installs
Turn uploaded datasets into executed analyses, charts, reports, dashboards, and cleaned files.
113 installs4 stars
Find and revise AI-writing patterns while preserving unaffected prose and protected content.
61 installs
More from Agent Bom
Browse all skillsScan agent dependencies, packages, images, and filesystems for CVEs, provenance issues, and blast radius.
by Agent Bom73 installs