How do I install the Agent Bom Compliance skill?

Run npx skillmds@latest add dvcrn/agent-bom-compliance in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Agent Bom Compliance safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Agent Bom Compliance?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Agent Bom Compliance free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Agent Bom Compliance?

dvcrn (@dvcrn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Agent Bom Compliance by dvcrn — Agent Skill

Name: Agent Bom Compliance
Rating: 4.666666666666667 (3 reviews)
Author: dvcrn

Agent Bom Compliance

AI compliance and policy engine — evaluate scan results against OWASP LLM Top 10, MITRE ATLAS, EU AI Act, NIST AI RMF, and custom policy-as-code rules. Generate SBOMs in CycloneDX or SPDX format. Use when the user mentions compliance checking, security policy enforcement, SBOM generation, or regulatory frameworks.

dvcrn Updated Sep 8, 2026 32 repo stars

File contents

agent-bom-compliance — AI Compliance & Policy Engine

Evaluate AI infrastructure scan results against security frameworks and enforce policy-as-code rules. Generate SBOMs in standard formats.

Install

pipx install agent-bom
agent-bom compliance        # run compliance check on latest scan
agent-bom generate-sbom     # generate CycloneDX SBOM

Tools (4)

Tool	Description
`compliance`	OWASP LLM/Agentic Top 10, EU AI Act, MITRE ATLAS, NIST AI RMF
`policy_check`	Evaluate results against custom security policy (17 conditions)
`cis_benchmark`	Run CIS benchmark checks against cloud accounts
`generate_sbom`	Generate SBOM (CycloneDX or SPDX format)

Supported Frameworks

OWASP LLM Top 10 (2025) — prompt injection, supply chain, data leakage
OWASP Agentic Top 10 — tool poisoning, rug pulls, credential theft
MITRE ATLAS — adversarial ML threat framework
EU AI Act — risk classification, transparency, SBOM requirements
NIST AI RMF — govern, map, measure, manage lifecycle
CIS Foundations — AWS, Azure v3.0, GCP v3.0, Snowflake benchmarks

Example Workflows

# Run compliance check
compliance(frameworks=["owasp_llm", "eu_ai_act"])

# Enforce custom policy
policy_check(policy={"max_critical": 0, "max_high": 5})

# Generate SBOM
generate_sbom(format="cyclonedx")

Privacy & Data Handling

All compliance evaluation runs locally on scan data already in memory. No files are read from disk (except user-provided SBOMs). No network calls. No credentials needed.

Verification

Source: github.com/msaad00/agent-bom (Apache-2.0)
3,400+ tests with CodeQL + OpenSSF Scorecard
No telemetry: Zero tracking, zero analytics

---name: agent-bom-compliancedescription: AI compliance and policy engine — evaluate scan results against OWASP LLM Top 10, MITRE ATLAS, EU AI Act, NIST AI RMF, and custom policy-as-code rules. Generate SBOMs in CycloneDX or SPDX format. Use when the user mentions compliance checking, security policy enforcement, SBOM generation, or regulatory frameworks.license: Apache-2.0---# agent-bom-compliance — AI Compliance & Policy EngineEvaluate AI infrastructure scan results against security frameworks and enforcepolicy-as-code rules. Generate SBOMs in standard formats.## Install```bashpipx install agent-bomagent-bom compliance # run compliance check on latest scanagent-bom generate-sbom # generate CycloneDX SBOM```## Tools (4)| Tool | Description ||------|-------------|| `compliance` | OWASP LLM/Agentic Top 10, EU AI Act, MITRE ATLAS, NIST AI RMF || `policy_check` | Evaluate results against custom security policy (17 conditions) || `cis_benchmark` | Run CIS benchmark checks against cloud accounts || `generate_sbom` | Generate SBOM (CycloneDX or SPDX format) |## Supported Frameworks- **OWASP LLM Top 10** (2025) — prompt injection, supply chain, data leakage- **OWASP Agentic Top 10** — tool poisoning, rug pulls, credential theft- **MITRE ATLAS** — adversarial ML threat framework- **EU AI Act** — risk classification, transparency, SBOM requirements- **NIST AI RMF** — govern, map, measure, manage lifecycle- **CIS Foundations** — AWS, Azure v3.0, GCP v3.0, Snowflake benchmarks## Example Workflows```# Run compliance checkcompliance(frameworks=["owasp_llm", "eu_ai_act"])# Enforce custom policypolicy_check(policy={"max_critical": 0, "max_high": 5})# Generate SBOMgenerate_sbom(format="cyclonedx")```## Privacy & Data HandlingAll compliance evaluation runs **locally on scan data already in memory**.No files are read from disk (except user-provided SBOMs). No network calls.No credentials needed.## Verification- **Source**: [github.com/msaad00/agent-bom](https://github.com/msaad00/agent-bom) (Apache-2.0)- **3,400+ tests** with CodeQL + OpenSSF Scorecard- **No telemetry**: Zero tracking, zero analytics

Frequently asked questions