agent-bom runtime

This Skill addresses the pain points of AI application runtime security monitoring. In practical development, AI agents' runtime behaviors often lack effective security auditing methods, making it difficult for developers to detect lateral movement, privilege abuse, or anomalous activities related to known CVEs. Traditional log analysis tools cannot comprehend the context graph of AI agents, causing security incidents to be buried in massive data.

Usage is straightforward: simply install the agent-bom tool, then query runtime audit logs using natural language instructions. For example, you can ask it to build the agent's context graph and analyze lateral movement paths; correlate audit logs with CVE databases to identify exploited vulnerabilities; or query historical vulnerability trends and runtime event statistics. It supports JSONL-format audit log files and can be configured to use ClickHouse as persistent analytical storage.

It is well-suited for operations teams and security engineers who need to ensure AI system security—particularly those who have deployed AI agent services and require runtime behavior monitoring, security incident investigation, and compliance auditing. For scenarios involving multi-agent collaboration or needing to track context propagation, this tool significantly enhances security analysis efficiency.

We recommend running this tool regularly for security inspections in CI/CD pipelines or production environments. Note that it primarily analyzes runtime audit logs and does not involve static code scanning. It requires Python 3.11+ and optionally kubectl for Kubernetes context. All analysis operations are performed in local memory without automatic data uploads, but if ClickHouse is configured, analysis results will be persistently stored.