agent-bom runtime

This Skill addresses the pain points of runtime security monitoring for AI applications. In practical deployments, the runtime behavior of AI agents may involve security threats such as lateral movement and privilege abuse, which are difficult for traditional log analysis to detect across components. This tool helps developers quickly identify security risks through context graph analysis, correlation of audit logs with CVE vulnerabilities, and vulnerability analysis queries.

Usage is straightforward: simply install the agent-bom package and invoke three core tools via natural language instructions. For example, use context_graph() to construct a context graph for lateral movement analysis, runtime_correlate(audit_file="proxy-audit.jsonl") to cross-reference audit logs with CVE discoveries, and analytics_query(query="top_cves", days=30) to query vulnerability trends and historical events. It supports JSONL-format audit log file input and optionally persists analysis results to ClickHouse.

It is well-suited for operations teams and security engineers who need to ensure the secure operation of AI systems. Particularly for enterprises deploying AI Agents, agent applications, or automated workflows that require real-time monitoring of runtime behavior, detection of anomalous activities, and rapid response. It is also applicable for agent developers to conduct security audits and compliance checks during the development phase, ensuring no latent risks before deployment.

It is recommended to use this tool uniformly in production environments of AI systems for continuous monitoring. Note that it primarily analyzes runtime audit logs and does not cover network traffic or host-level intrusion detection. It requires a Python 3.11+ environment, with optional dependencies on kubectl and ClickHouse. Zero credentials are required—no API keys needed—but audit logs may contain environment variable names; ensure raw values are not leaked.