Agent Bom Compliance Agent Skill

agent-bom-compliance — AI Compliance & Policy Engine

Evaluate AI infrastructure scan results against 14 security and regulatory

frameworks. Enforce policy-as-code rules. Generate SBOMs in standard formats.

Run AISVS v1.0 and CIS benchmark checks.

Install

pipx install agent-bom
agent-bom agents -f compliance-export  # run agents scan with compliance export
agent-bom generate-sbom                # generate CycloneDX SBOM

When to Use

• "compliance report" / "run compliance"
• "NIST" / "NIST AI RMF" / "NIST CSF" / "NIST 800-53"
• "SOC 2" / "SOC2"
• "ISO 27001"
• "OWASP" / "OWASP LLM Top 10" / "OWASP Agentic Top 10"
• "EU AI Act"
• "AISVS" / "AI Security Verification Standard"
• "CMMC" / "FedRAMP"
• "generate SBOM" / "CycloneDX" / "SPDX"
• "policy check" / "policy enforcement"

Tools (5)

| Tool | Description |

|------|-------------|

| compliance | OWASP LLM/Agentic Top 10, EU AI Act, MITRE ATLAS, NIST AI RMF |

| policy_check | Evaluate results against custom security policy (17 conditions) |

| cis_benchmark | Run CIS benchmark checks against cloud accounts |

| generate_sbom | Generate SBOM (CycloneDX or SPDX format) |

| aisvs_benchmark | OWASP AISVS v1.0 compliance — 9 AI security checks |

Supported Frameworks (14)

• OWASP LLM Top 10 (2025) — prompt injection, supply chain, data leakage
• OWASP MCP Top 10 — MCP-specific security risks
• OWASP Agentic Top 10 — tool poisoning, rug pulls, credential theft
• OWASP AISVS v1.0 — AI Security Verification Standard (9 checks)
• MITRE ATLAS — adversarial ML threat framework
• NIST AI RMF — govern, map, measure, manage lifecycle
• NIST CSF 2.0 — identify, protect, detect, respond, recover
• NIST 800-53 Rev 5 — federal security controls (CM-8, RA-5, SI-2, SR-3)
• FedRAMP Moderate — derived from NIST 800-53 controls
• EU AI Act — risk classification, transparency, SBOM requirements
• ISO 27001:2022 — information security controls (Annex A)
• SOC 2 — Trust Services Criteria
• CIS Controls v8 — implementation groups IG1/IG2/IG3
• CMMC 2.0 — cybersecurity maturity model (Level 1-3)

Examples

# Run compliance check against multiple frameworks
compliance(frameworks=["owasp_llm", "eu_ai_act", "nist_ai_rmf"])

# Enforce custom policy
policy_check(policy={"max_critical": 0, "max_high": 5})

# Generate SBOM
generate_sbom(format="cyclonedx")

# Run AISVS v1.0 compliance
aisvs_benchmark()

# Run AWS CIS benchmark
cis_benchmark(provider="aws")

Privacy & Data Handling

**OWASP, NIST, EU AI Act, MITRE ATLAS, AISVS, SBOM generation, and policy

checks** run entirely locally on scan data already in memory. No network calls,

no credentials needed for these features.

CIS benchmark checks (optional, user-initiated) call cloud provider APIs

using your locally configured credentials. These are read-only API calls to

AWS, Azure, GCP, or Snowflake. You must explicitly run cis_benchmark(provider=...)

and confirm before any cloud API calls are made.

Verification

• Source: github.com/msaad00/agent-bom (Apache-2.0)
• 6,533+ tests with CodeQL + OpenSSF Scorecard
• No telemetry: Zero tracking, zero analytics