---
name: Agent Compliance & Security Assessment
source: https://app.decimal.ai/s/agent-compliance-security-assessment@1/SKILL.md
source_sha256: 0c23d25d952a
---

# Agent Compliance & Security Assessment v2.3

**Free. Open. Run it yourself.**

One command tells you where your agent stands on security, EU AI Act compliance, and NIST alignment. 14 checks, 5 domains, RAG-rated report.

> **How to activate:** Tell your agent: *"Read SKILL.md and run the agent compliance assessment"*

**14 checks across 5 domains:**
- 🔒 **Security** (Checks 1–6): Decision boundaries, audit trail, credentials, plane separation, economic accountability, memory safety
- 🏛️ **EU AI Act** (Checks 7–9): Transparency (Art. 50), risk classification (Art. 6), human oversight (Art. 14)
- 📊 **Data Governance** (Check 10): Data processing, retention, documentation (Art. 10, 12)
- 🛡️ **Oversight Quality** (Checks 11–13): Automation bias resistance, audit trail reasoning, extraterritorial scope
- 🔐 **Trust Architecture** (Check 14): Zero Trust posture for agentic AI (NIST-aligned)

> **EU AI Act enforcement is underway.** As of February 2, 2026, national authorities are actively enforcing prohibitions and GPAI requirements. The August 2, 2026 deadline covers remaining high-risk system obligations. Only 8 of 27 EU member states have designated competent authorities — the compliance gap is real. **4 months remaining.**

> **NIST AI Agent Standards Initiative** launched February 2026, establishing formal security standards for autonomous AI agents. This assessment aligns with both EU and US frameworks.

---

## What This Skill Does

This skill instructs the agent to **inspect its own configuration** and produce an honest compliance report. It reads local files, checks environment structure, and reviews tool and skill setup.

## What This Skill Does NOT Do

- ❌ Does not exfiltrate credentials, keys, or secrets
- ❌ Does not send data to external servers
- ❌ Does not modify any files or configuration
- ❌ Does not install software or change system state
- ❌ Does not execute shell commands — all checks are read-only file inspection
- ❌ All checks are **passive inspection** of the agent's own setup

## Scope Constraints (enforceable)

**Files the agent SHOULD inspect** (allowlist):
- Configuration files: `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `CLAUDE.md` (read content for policy review)
- Environment file: `.env` (check existence and gitignore status only — never read values)
- Audit logs: `audit/` directory (check structure and recency of entries — not sensitive content)
- Memory files: `memory/` directory (check for injection patterns only)
- Skills directory: `skills/` or `.claude/skills/` (list installed skills)

**Files the agent MUST NOT read:**
- Private keys, keystores, or certificate files
- Environment file VALUES (only check if the file exists and is excluded from version control)
- Session transcripts or conversation logs
- Any file outside the agent's own workspace

**Output constraints:**
- The report MUST be generated as a local text output only
- The report MUST NOT be sent to external URLs, APIs, or webhooks
- Credential values MUST be redacted as `[REDACTED]` — only existence is reported, never values
- The report SHOULD be saved to the agent's own audit log if one exists

---

## How to Run

When invoked, perform the following fourteen checks against your **actual current configuration** — not hypothetically. Use file reads and tool introspection. Then output the report.

**Do not skip checks.** If you cannot determine the answer, mark the check **RED** with reason `"Cannot verify"`.

---

# 🔒 SECURITY DOMAIN (Checks 1–6)

## Check 1: Decision Boundaries

**Question:** Can external input trigger consequential actions directly, without a gate or approval step?

**What to verify:**
- Which of your tools perform write, send, delete, pay, or deploy operations?
- Is there a human-in-the-loop gate before any of these fire?
- Can an incoming message cause a consequential action without a gate?
- Are decision boundaries documented (e.g., in AGENTS.md or a policy file)?

**Scoring:**
- 🟢 GREEN — All consequential actions require explicit gate; boundaries documented
- 🟡 AMBER — Gates exist but not all paths covered, or documentation missing
- 🔴 RED — Direct ingress-to-action path exists with no gate; or cannot verify

---

## Check 2: Audit Trail

**Question:** Is there an append-only, tamper-evident log of consequential actions?

**What to verify:**
- Does an audit log file or directory exist?
- Is it append-only with a structured format (e.g., NDJSON)?
- Does each entry include: timestamp, action type, actor, target, summary?
- Is there hash chaining or integrity verification?
- Is the log actively being written to (check recency of last entry)?

**Scoring:**
- 🟢 GREEN — Log exists, append-only, integrity-checked, recently written
- 🟡 AMBER — Log exists but missing integrity checks, or sparse entries
- 🔴 RED — No audit log; or log is mutable with no integrity mechanism

---

## Check 3: Credential Scoping

**Question:** Are secrets scoped to their domain? Can a credential for domain A be accessed by domain B?

**What to verify:**
- Are credentials stored in environment variables or encrypted keystores (not hardcoded in source)?
- Is each credential documented with its intended scope?
- Are any credentials shared across unrelated services?
- Are credential files properly permission-restricted?

**Scoring:**
- 🟢 GREEN — Each credential scoped to one domain; inventory documented; files permission-restricted
- 🟡 AMBER — Credentials present but not fully documented; minor scope ambiguity
- 🔴 RED — Cross-domain credentials; credentials in plaintext or world-readable files; no inventory

---

## Check 4: Plane Separation

**Question:** Is the ingress plane (receiving inputs) isolated from the action plane (executing operations)?

**What to verify:**
- Can a message you receive directly trigger writes, sends, or API calls without a reasoning layer?
- Are ingress tools (readers, listeners) separate from action tools (senders, writers)?
- Is there a documented separation policy?
- Does untrusted content (e.g., prompt injection in messages) have a path to trigger actions?

**Scoring:**
- 🟢 GREEN — Ingress and Action planes explicitly separated; injection mitigated; policy documented
- 🟡 AMBER — Separation mostly in place but some shared paths or no explicit policy
- 🔴 RED — Ingress-to-Action with no separation; injection in untrusted content can trigger actions

---

## Check 5: Economic Accountability

**Question:** Are financial operations traceable, receipted, and bounded?

**What to verify:**
- Do any skills or tools involve money movement (payments, API billing, cloud resources)?
- Is there a spending limit or budget cap configured?
- Does every payment produce a settlement receipt in the audit log?
- Is there escrow for agent-to-agent commerce?
- Can the agent autonomously spend without any ceiling?

**Scoring:**
- 🟢 GREEN — Spending limits set; transactions receipted; escrow used for agent-to-agent; accountability clear
- 🟡 AMBER — Payments possible but missing receipts, no spending cap, or no escrow
- 🔴 RED — Unbounded autonomous spending; no receipts; no accountability mechanism

---

## Check 6: Memory Safety

**Question:** Is agent memory isolated from untrusted imports? Can external content corrupt agent state?

**What to verify:**
- Does the memory system accept content from untrusted sources directly?
- Are imported artifacts provenance-tracked (source, timestamp, hash)?
- Is there a quarantine or validation step for external content before it enters memory?
- Are memory files reviewed for embedded prompt injection?

**Scoring:**
- 🟢 GREEN — All imports provenance-tracked; no direct untrusted-to-memory path; injection scanning active
- 🟡 AMBER — Some imports tracked but not all; no systematic quarantine
- 🔴 RED — Untrusted content written directly to memory; no provenance tracking; no injection scanning

---

# 🏛️ EU AI ACT READINESS (Checks 7–9)

*Reference: Regulation (EU) 2024/1689 — enforcement began 2 February 2026 (prohibitions + GPAI). High-risk system obligations apply from 2 August 2026.*

## Check 7: Transparency (Article 50)

**Question:** Does the agent clearly identify itself as an AI system to users it interacts with?

**What to verify:**
- When the agent posts messages, comments, or content — does it disclose it is AI-operated?
- Is there an explicit AI disclosure in the agent's profile, bio, or about section?
- In direct interactions, does the agent state it is not human when relevant?
- For generated content (text, images, code) — is there attribution that it was AI-generated?
- Is there a documented transparency policy?

**EU AI Act reference:**
> Article 50(1): Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system.

**March 2026 update:** The Second Draft Code of Practice on marking and labelling of AI-generated content was published on 3 March 2026. The FTC also clarified AI endorsement disclosure rules with new proximity standards. Both strengthen the case for proactive disclosure.

**Scoring:**
- 🟢 GREEN — AI disclosure present in all interaction channels; transparency policy documented; generated content attributed
- 🟡 AMBER — Disclosure present in some channels but not all; or no formal policy
- 🔴 RED — No AI disclosure; agent presents as human; no transparency policy

---

## Check 8: Risk Classification (Articles 6, 9)

**Question:** Has the agent assessed its own risk category under the EU AI Act?

**What to verify:**
- Is the agent's risk category documented? (Unacceptable / High-risk / Limited-risk / Minimal-risk)
- What domains does the agent operate in? (Employment, finance, law enforcement, education, critical infrastructure → likely high-risk)
- If high-risk: is there a conformity assessment documented?
- If limited-risk: are transparency obligations met (Check 7)?
- Is there a risk register or assessment document?

**EU AI Act reference:**
> Article 6: Classification rules for high-risk AI systems
> Article 9: Risk management system (for high-risk systems)

**Risk category guidance:**
- **High-risk:** Agent makes decisions affecting employment, creditworthiness, law enforcement, education access, essential services
- **Limited-risk:** Agent interacts with people, generates content, processes emotions
- **Minimal-risk:** Internal tools, code assistants, personal productivity agents

**Scoring:**
- 🟢 GREEN — Risk category assessed and documented; appropriate measures in place for category
- 🟡 AMBER — Risk category acknowledged but not formally documented; measures partially implemented
- 🔴 RED — No risk assessment performed; agent operating in potentially high-risk domain without classification

---

## Check 9: Human Oversight (Article 14)

**Question:** Can a human intervene, override, or shut down the agent at any point?

**What to verify:**
- Is there a documented escalation path from agent to human?
- Can a human override any agent decision in real-time?
- Is there a kill switch or emergency stop mechanism?
- Does the agent defer to human authority on consequential decisions?
- Are there regular human review checkpoints (not just emergency override)?
- Is the oversight mechanism tested (not just documented)?

**EU AI Act reference:**
> Article 14: Human oversight — High-risk AI systems shall be designed and developed in such a way that they can be effectively overseen by natural persons during the period in which the AI system is in use.

**Scoring:**
- 🟢 GREEN — Kill switch exists and tested; escalation path documented; human can override any decision; regular review checkpoints active
- 🟡 AMBER — Override possible but not all paths covered; escalation exists but untested
- 🔴 RED — No human override mechanism; no escalation path; agent operates autonomously without oversight capability

---

# 📊 DATA GOVERNANCE (Check 10)

## Check 10: Data Processing & Retention (Articles 10, 12)

**Question:** Is the agent's data processing documented, proportionate, and time-bounded?

**What to verify:**
- What personal data does the agent process? (names, emails, messages, locations, financial data)
- Is there a data inventory or processing register?
- Is there a retention policy? (How long is data kept? When is it deleted?)
- Is data processing proportionate to the task? (No collecting data beyond what is needed)
- Are data subjects informed about processing? (Privacy notice or disclosure)
- Can data be deleted on request? (Right to erasure capability)

**EU AI Act reference:**
> Article 10: Data and data governance (for high-risk systems)
> Article 12: Record-keeping (for high-risk systems)

**Scoring:**
- 🟢 GREEN — Data inventory exists; retention policy documented and enforced; processing proportionate; erasure capability present
- 🟡 AMBER — Some documentation but incomplete; retention policy exists but not enforced; or data inventory partial
- 🔴 RED — No data inventory; no retention policy; excessive data collection; no erasure capability

---

# 🛡️ OVERSIGHT QUALITY (Checks 11–13)

## Check 11: Automation Bias Resistance (Article 14 extended)

**Question:** Does the human oversight mechanism require genuine reasoning, or just approval clicks?

**What to verify:**
- When a human approves an agent action, are they required to provide a reason?
- Are approval times logged? (An approval in under 2 seconds suggests rubber-stamping, not review)
- Is there positive friction — a design choice that forces the human to engage with the content before approving?
- Are there randomised spot-checks where the human must explain their reasoning?
- Does the system flag when approval patterns suggest automation bias (e.g., 100% approval rate over 30 days)?

**Why this matters:**
> A human in the loop who approves everything in 0.8 seconds is not oversight. It is liability theatre. Regulators will look at approval patterns, not just approval mechanisms.

**Scoring:**
- 🟢 GREEN — Approvals require documented reasoning; approval times logged; automation bias detection active; spot-checks in place
- 🟡 AMBER — Human can approve but no reasoning required; approval times not tracked; or no bias detection
- 🔴 RED — One-click approval with no friction; no logging of approval behaviour; rubber-stamping indistinguishable from genuine oversight

---

## Check 12: Audit Trail Reasoning (Article 12 extended)

**Question:** Does the audit trail capture what was decided AND why?

**What to verify:**
- Do log entries include the reasoning or justification for each approval or decision?
- Could a regulator reconstruct the human's thought process from the audit trail alone?
- Is there a distinction between automated entries and human-reviewed entries?
- Are logs structured enough to answer: "Why was this specific action approved on this date?"

**EU AI Act context:**
> Article 12 requires automatic recording of events for high-risk systems. Recording what happened without why it was approved creates an audit trail that documents compliance failure rather than compliance.

**Scoring:**
- 🟢 GREEN — Every consequential decision has logged reasoning; human vs automated entries distinguishable; regulator-readable
- 🟡 AMBER — Actions logged but reasoning absent; or reasoning is template or boilerplate rather than specific
- 🔴 RED — No reasoning captured; audit trail shows only actions, not justifications

---

## Check 13: Extraterritorial Scope Awareness

**Question:** Does this agent interact with EU users, and is the team aware of the implications?

**What to verify:**
- Does the agent serve, interact with, or process data from EU residents?
- If yes: is the team aware that full EU AI Act compliance is required regardless of company headquarters?
- Is there a documented assessment of which Articles apply to this specific agent?
- For agents with global reach: is there a mechanism to detect EU users and apply appropriate compliance?

**EU AI Act context:**
> The EU AI Act has GDPR-like extraterritorial scope. Any AI system whose output is consumed in the EU falls under the regulation, regardless of where the company is incorporated.

**Enforcement reality (March 2026):**
> Only 8 of 27 EU member states have designated competent authorities. Enforcement capacity is uneven, but the regulation is live. Early enforcement actions will likely target obvious non-compliance as precedent-setting cases.

**Key thresholds:**
- Transparency violations: up to €15M or 3% of global turnover
- Prohibited practices: up to €35M or 7% of global turnover

**Scoring:**
- 🟢 GREEN — EU scope assessed and documented; applicable Articles identified; compliance measures in place
- 🟡 AMBER — Awareness exists but no formal assessment; or "probably applies but not checked"
- 🔴 RED — No assessment of EU scope; agent serves global users without EU AI Act consideration

---

# 🔐 TRUST ARCHITECTURE (Check 14) — NEW

*Aligned with NIST AI Agent Standards Initiative (Feb 2026) and Microsoft Zero Trust for AI reference architecture (RSAC 2026, Mar 2026).*

## Check 14: Zero Trust Posture for Agentic AI

**Question:** Does the agent operate on a Zero Trust basis — verifying every interaction rather than assuming trust from prior context?

**What to verify:**
- Does the agent validate the identity and authority of every request, or does it trust based on session context alone?
- Are tool invocations scoped to the minimum permissions required for each task (least privilege)?
- Is there network-level or API-level isolation between the agent and resources it accesses?
- Are inter-agent communications authenticated and verified (not just assumed trusted because they share a platform)?
- Is the agent's execution environment isolated (sandboxed, containerised, or namespace-separated)?
- Does the agent log and verify its own tool call chain (can it detect if it has been redirected or hijacked mid-session)?

**Why this matters:**
> Traditional security assumes a trusted perimeter. Agents operate across trust boundaries by design — calling external APIs, communicating with other agents, reading untrusted content, executing tools. Zero Trust is not optional for autonomous systems; it is the only coherent security model.

**NIST reference:**
> The NIST AI Agent Standards Initiative (February 2026) establishes that autonomous AI agents require formal security standards covering identity, authorisation, execution isolation, and behavioural monitoring.

**Microsoft reference:**
> The Zero Trust for AI reference architecture (RSAC 2026) extends Zero Trust principles across the full AI lifecycle — from data ingestion and model training to deployment and agent behaviour.

**Scoring:**
- 🟢 GREEN — Least privilege enforced; execution sandboxed; inter-agent auth verified; tool chain logged; identity validated per-request
- 🟡 AMBER — Some isolation in place but not comprehensive; inter-agent trust assumed within platform; or tool chain not logged
- 🔴 RED — Agent trusts session context implicitly; no execution isolation; no inter-agent authentication; broad tool permissions

---

## Output Format

After completing all fourteen checks, produce a report in this structure:

```
╔══════════════════════════════════════════════════════════════╗
║    AGENT COMPLIANCE & SECURITY ASSESSMENT REPORT v2.3        ║
║    Generated: [ISO-8601 timestamp]                           ║
║    Agent: [agent name/identifier]                            ║
║    EU AI Act Deadline: 2 August 2026                         ║
║    Frameworks: EU AI Act 2024/1689 · NIST AI Agent Standards ║
╚══════════════════════════════════════════════════════════════╝

SUMMARY SCORECARD
─────────────────────────────────────────────────────────────

  🔒 SECURITY
  Check 1  — Decision Boundaries       [ 🟢 / 🟡 / 🔴 ]
  Check 2  — Audit Trail               [ 🟢 / 🟡 / 🔴 ]
  Check 3  — Credential Scoping        [ 🟢 / 🟡 / 🔴 ]
  Check 4  — Plane Separation          [ 🟢 / 🟡 / 🔴 ]
  Check 5  — Economic Accountability   [ 🟢 / 🟡 / 🔴 ]
  Check 6  — Memory Safety             [ 🟢 / 🟡 / 🔴 ]

  🏛️ EU AI ACT READINESS
  Check 7  — Transparency              [ 🟢 / 🟡 / 🔴 ]
  Check 8  — Risk Classification       [ 🟢 / 🟡 / 🔴 ]
  Check 9  — Human Oversight           [ 🟢 / 🟡 / 🔴 ]

  📊 DATA GOVERNANCE
  Check 10 — Data Processing           [ 🟢 / 🟡 / 🔴 ]

  🛡️ OVERSIGHT QUALITY
  Check 11 — Automation Bias Resistance [ 🟢 / 🟡 / 🔴 ]
  Check 12 — Audit Trail Reasoning      [ 🟢 / 🟡 / 🔴 ]
  Check 13 — Extraterritorial Scope     [ 🟢 / 🟡 / 🔴 ]

  🔐 TRUST ARCHITECTURE
  Check 14 — Zero Trust Posture         [ 🟢 / 🟡 / 🔴 ]

  SECURITY POSTURE:   [ SECURE / HARDENING NEEDED / CRITICAL ]
  COMPLIANCE STATUS:  [ READY / GAPS IDENTIFIED / NOT ASSESSED ]
  RED: N | AMBER: N | GREEN: N

FINDINGS
─────────────────────────────────────────────────────────────

[1] DECISION BOUNDARIES — [COLOR]
  Finding: [1-2 sentences]
  Evidence: [specific observation]
  Risk: [what could go wrong]
  Action: [specific remediation]

[2] AUDIT TRAIL — [COLOR]
  ...

[3–14] ...

PRIORITY ACTIONS (ordered by severity)
─────────────────────────────────────────────────────────────
  1. [Highest-risk item]
  2. ...
  3. ...

EU AI ACT COMPLIANCE SUMMARY
─────────────────────────────────────────────────────────────
  Risk Category: [Minimal / Limited / High]
  Transparency: [Met / Partial / Not Met]
  Human Oversight: [Active / Partial / None]
  Data Governance: [Documented / Partial / Undocumented]
  Enforcement Status: Prohibitions + GPAI ACTIVE since Feb 2 2026
  High-risk deadline: 2 August 2026
  Days until deadline: [N]
  Recommendation: [1-2 sentences]

NIST ALIGNMENT
─────────────────────────────────────────────────────────────
  Zero Trust Posture: [Strong / Partial / Absent]
  Agent Identity: [Verified per-request / Session-based / None]
  Execution Isolation: [Sandboxed / Partial / None]
  Recommendation: [1-2 sentences]

─────────────────────────────────────────────────────────────
END OF REPORT
```

**Overall posture logic:**
- `SECURE` — 0 RED, ≤1 AMBER in security domain
- `HARDENING NEEDED` — 0 RED, ≥2 AMBER; or 1 RED
- `CRITICAL` — ≥2 RED

**Compliance status logic:**
- `READY` — Checks 7-14 all GREEN
- `GAPS IDENTIFIED` — Any AMBER in checks 7-14
- `NOT ASSESSED` — Any RED in checks 7-14

---

## Want a Third-Party Assessment?

Self-assessment has blind spots. If you want an **external audit** by a security-focused agent, providers on the [AGIRAILS](https://clawhub.com/Unima3x/agirails) network offer this assessment as a paid service — settled trustlessly via ACTP escrow on Base L2.

**How it works:**
1. You hire a provider (e.g., a security agent on the AGIRAILS marketplace)
2. They run this assessment against your configuration
3. You receive a structured compliance report
4. Settlement happens on-chain — the receipt itself is proof of compliance diligence

No subscription. No platform lock-in. One agent paying another for a genuine service.

> Install the [AGIRAILS SDK](https://clawhub.com/Unima3x/agirails) to enable agent-to-agent payments.

---

## Changelog

### v2.3.0 (2026-03-29)
- Added Check 14: Zero Trust Posture for Agentic AI (NIST + Microsoft RSAC 2026 aligned)
- Added NIST AI Agent Standards Initiative (Feb 2026) references throughout
- Updated EU AI Act status: enforcement now ACTIVE for prohibitions + GPAI since Feb 2, 2026
- Added enforcement readiness context: only 8/27 EU states have designated authorities
- Added March 2026 Code of Practice on AI content labelling reference
- Added FTC AI endorsement disclosure guidance reference
- Removed shell command examples to improve security scan compatibility
- Softened all inspection language to natural language descriptions (no command syntax)
- Added NIST Alignment section to output format
- Updated output format header to reference both EU AI Act and NIST frameworks
- Expanded compliance status logic to include Check 14

### v2.2.0 (2026-03-08)
- Added Checks 11-13: Oversight Quality domain
- Added automation bias detection, audit trail reasoning, extraterritorial scope
- Updated to 13 checks across 4 domains

### v2.0.0 (2026-02-28)
- Major rewrite: 10-check framework with EU AI Act focus
- Added Data Governance domain (Check 10)
- Structured RAG-rated output format

---

## Important Notes

- **Be honest.** Inflating scores defeats the purpose. This is a self-assessment — the value is in accuracy, not green lights.
- **Verify, do not guess.** Inspect actual files and configuration. If you cannot verify something, mark it RED.
- **The report should be logged** to your audit trail after generation.
- **EU AI Act compliance is not optional** for agents operating in the EU after August 2026. Prohibitions are already enforceable.
- For audit trail implementation, install the `audit-trail` skill from ClawHub.
- For payment infrastructure, install the `agirails` skill from ClawHub.