Agent Bom Compliance

What it does

When your agent uses it

• : compliance report
• Tasks that involve SOC 2 and security compliance
• Tasks that involve AI governance

Example prompts

• “compliance report”
• “ISO 27001”
• “EU AI Act”
• “/agent-bom-compliance”

Requirements

• Python 3
• Docker
• A credential in AZURE_CLIENT_SECRET
• Compatibility (from SKILL.md): Requires Python 3.11+. Install via pipx or pip. OWASP/NIST/EU AI Act/MITRE evaluation and SBOM generation are fully local with zero credentials. CIS benchmark checks optionally use cloud SDK credentials (AWS/Azure/GCP/Snowflake) and make read-only API calls to cloud providers when explicitly invoked.

What it can do on your machine

Read from SKILL.md and the folder at commit e5199b5. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • pipx

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • github.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Requires Python 3.11+. Install via pipx or pip. OWASP/NIST/EU AI Act/MITRE evaluation and SBOM generation are fully local with zero credentials. CIS benchmark checks optionally use cloud SDK credentials (AWS/Azure/GCP/Snowflake) and make read-only API calls to cloud providers when explicitly invoked.

  From compatibility in the SKILL.md frontmatter.

Context cost

Agent Bom Compliance loads about 1.9k tokens when it runs. Until then it costs about 83 tokens; SKILL.md has 332 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~83

When it runs · the whole SKILL.md, loaded when a task matches

~1.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from LeoYeAI/openclaw-master-skills at commit e5199b5, republished under its Apache-2.0 licence (© LeoYeAI). 332 words, ~1,869 tokens.

name

agent-bom-compliance

description

AI compliance and policy engine — evaluate scan results against OWASP, NIST, SOC 2, ISO 27001, CMMC, EU AI Act, AISVS v1.0, and related frameworks. Generate SBOMs and compliance reports. Use when: "compliance report", "NIST", "SOC 2", "ISO 27001", "OWASP", "EU AI Act", "AISVS", "generate SBOM", "policy check".

compatibility

Requires Python 3.11+. Install via pipx or pip. OWASP/NIST/EU AI Act/MITRE evaluation and SBOM generation are fully local with zero credentials. CIS benchmark checks optionally use cloud SDK credentials (AWS/Azure/GCP/Snowflake) and make read-only API calls to cloud providers when explicitly invoked.

version

0.75.10

license

Apache-2.0

metadata.author

msaad00

metadata.homepage

https://github.com/msaad00/agent-bom

metadata.source

https://github.com/msaad00/agent-bom

metadata.pypi

https://pypi.org/project/agent-bom/

metadata.scorecard

https://securityscorecards.dev/viewer/?uri=github.com/msaad00/agent-bom

metadata.tests

6533

pipx install agent-bom
agent-bom agents -f compliance-export  # run agents scan with compliance export
agent-bom generate-sbom                # generate CycloneDX SBOM

# Run compliance check against multiple frameworks
compliance(frameworks=["owasp_llm", "eu_ai_act", "nist_ai_rmf"])

# Enforce custom policy
policy_check(policy={"max_critical": 0, "max_high": 5})

# Generate SBOM
generate_sbom(format="cyclonedx")

# Run AISVS v1.0 compliance
aisvs_benchmark()

# Run AWS CIS benchmark
cis_benchmark(provider="aws")

© LeoYeAI, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/agent-bom/compliance of LeoYeAI/openclaw-master-skills.

Open the folder on GitHubat commit e5199b5