agent-bom runtime

This Skill addresses a critical pain point in AI runtime security monitoring. In real-world development, AI applications and agents generate a large volume of audit logs during runtime. However, traditional monitoring tools often fail to correlate these logs with known CVE vulnerabilities and struggle to build context graphs for detecting attack paths like lateral movement. Developers are forced to manually analyze logs and query vulnerability databases, which is inefficient and prone to oversight.

Usage is straightforward. Simply install the agent-bom package and operate it via natural language instructions. For example, you can say, "Analyze the runtime audit logs of the current project and correlate them with CVE vulnerabilities." It will automatically read the JSONL-format audit file you provide, invoke the context_graph tool to build a context graph, then use the runtime_correlate tool to cross-reference the logs with CVE data, and finally query vulnerability trends and event history via analytics_query. The entire process runs locally in memory without requiring manual API key configuration.

It is ideally suited for DevOps engineers, backend developers, and security auditors responsible for securing AI applications. Teams that have already deployed AI agents or intelligent systems can use this tool to quickly identify potential runtime risks such as lateral movement, privilege abuse, and vulnerability exploitation. It also significantly improves efficiency for scenarios requiring regular security report generation or compliance audits.

It is recommended to perform a runtime security scan with this tool after each AI application version update or new agent deployment. Note that its analysis primarily relies on the audit log file (JSONL format) you provide; incomplete or malformed logs may limit the results. Optionally, you can configure ClickHouse for persistent analysis data storage, but this is not required.