Agent Compliance & Security Assessment v2.3

Agent Compliance & Security Assessment v2.3

Free. Open. Run it yourself.

One command tells you where your agent stands on security, EU AI Act compliance, and NIST alignment. 14 checks, 5 domains, RAG-rated report.

How to activate: Tell your agent: "Read SKILL.md and run the agent compliance assessment"

14 checks across 5 domains:

• 🔒 Security (Checks 1–6): Decision boundaries, audit trail, credentials, plane separation, economic accountability, memory safety
• 🏛️ EU AI Act (Checks 7–9): Transparency (Art. 50), risk classification (Art. 6), human oversight (Art. 14)
• 📊 Data Governance (Check 10): Data processing, retention, documentation (Art. 10, 12)
• 🛡️ Oversight Quality (Checks 11–13): Automation bias resistance, audit trail reasoning, extraterritorial scope
• 🔐 Trust Architecture (Check 14): Zero Trust posture for agentic AI (NIST-aligned)

EU AI Act enforcement is underway. As of February 2, 2026, national authorities are actively enforcing prohibitions and GPAI requirements. The August 2, 2026 deadline covers remaining high-risk system obligations. Only 8 of 27 EU member states have designated competent authorities — the compliance gap is real. 4 months remaining.

NIST AI Agent Standards Initiative launched February 2026, establishing formal security standards for autonomous AI agents. This assessment aligns with both EU and US frameworks.

What This Skill Does

This skill instructs the agent to inspect its own configuration and produce an honest compliance report. It reads local files, checks environment structure, and reviews tool and skill setup.

What This Skill Does NOT Do

• ❌ Does not exfiltrate credentials, keys, or secrets
• ❌ Does not send data to external servers
• ❌ Does not modify any files or configuration
• ❌ Does not install software or change system state
• ❌ Does not execute shell commands — all checks are read-only file inspection
• ❌ All checks are passive inspection of the agent's own setup

Scope Constraints (enforceable)

Files the agent SHOULD inspect (allowlist):

• Configuration files: AGENTS.md, SOUL.md, TOOLS.md, CLAUDE.md (read content for policy review)
• Environment file: .env (check existence and gitignore status only — never read values)
• Audit logs: audit/ directory (check structure and recency of entries — not sensitive content)