agent-bom compliance

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:17 PM UTC
• Version: 0.104.0

Overview

The skill is a coherent compliance and SBOM helper, with disclosed optional read-only cloud checks, but users should install carefully because the PyPI command is unpinned.

Install in a controlled environment and prefer a pinned package version or reviewed source before use. Only run CIS benchmark checks with least-privilege cloud credentials, and verify that any cloud check prompt matches the provider and account you intended to inspect.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:108
• Finding: Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 108–112 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash pipx install agent-bom agent-bom scan --compliance --compliance-export nist-ai-rmf agent-bom scan -f cyclonedx -o sbom.json ``` ### Technical Analysis The installation command retrieves the current `agent-bom` release from PyPI without pinning its version or verifying an artifact hash or signature. Consequently, the code installed when this instruction is followed may differ from the version reviewed or described by the Skill. The project artifact contains only `SKILL.md`; it does not include the package source, a lock file, or integrity metadata with which to audit or verify the installed implementation. Although the metadata refers to version `0.104.0`, the documented command does not enforce that version. This creates a mutable software-supply-chain boundary. If the publisher account, package registry, release workflow, or a future release is compromised, following the installation instructions could cause attacker-controlled Python code to execute with the user's privileges. ### Attack Path 1. An attacker compromises the package publisher, publication workflow, registry distribution path, or a future package release. 2. The attacker publishes a malicious version of `agent-bom`. 3. A user follows the Skill's `pipx install agent-bom` instruction. 4. `pipx` resolves and installs the attacker-controlled current release because no version or integrity constraint is specified. 5. The malicious package executes during installation or subsequent `agent-bom` invocation. 6. It may access resources available to the user, including files, environment variables, and any locally configured cloud credentials present during optional CIS benchmark operations. ### Impact Assessment Successful exploitation permits code execution with the privileges of the account installing or invoking the ...[truncated 422 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to the version declared in the Skill metadata: ```bash pipx install agent-bom==0.104.0 ``` 2. Verify downloaded artifacts using trusted cryptographic hashes or publisher signatures before installation. 3. Publish a reproducible requirements or lock artifact containing exact versions and integrity hashes. 4. Review the source and distribution artifact for each version before updating the pin. 5. Perform installation in an isolated environment without cloud credentials or unrelated secrets. 6. Use a separately authenticated, least-privilege environment only when explicitly running cloud CIS checks. 7. Consider referencing an immutable source commit or digest-pinned container image rather than a mutable package or image tag.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

env: []
      credentials: none
    credential_policy: "Zero credentials required for OWASP/NIST/EU AI Act compliance and SBOM generation. CIS benchmark checks (AWS, Azure, GCP, Snowflake) optionally accept cloud credentials — only used locally to call cloud APIs, never transmitted elsewhere."
    credential_handling: "Use only operator-configured cloud SDK credentials for explicitly requested CIS checks. Do not ask users to paste secrets, and never print cloud tokens, private keys, passwords, or connection strings."
    optional_env:
      - name: AWS_PROFILE
        purpose: "AWS CIS benchmark checks — uses boto3 with your local AWS profile"

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: Standalone framework names like "NIST", "SOC 2", "ISO 27001", and "OWASP" are highly generic and likely to appear in many discussions, so they can cause this skill to activate when the user is only asking conceptual questions. Because this skill can generate reports and, in some modes, initiate read-only cloud API checks with local credentials when explicitly invoked, overly broad routing increases the risk of unintended security-sensitive actions or confusing tool selection.

Vague Triggers

Low

• Confidence: 95% confidence
• Finding: The activation phrase "run compliance" is broad enough to match many ordinary user requests that are not specifically asking for this skill, increasing the chance of unintended invocation. In this skill, unintended invocation could cause policy evaluation or preparation for cloud benchmark actions in contexts where the user did not intend to use this toolchain.

Static analysis

No suspicious patterns detected.