AgentAudit
← back

Sample AIBOM — fixtures/vulnerable_agent.py

A real, freshly-generated AI Bill of Materials — a valid CycloneDX 1.6 BOM, the same out/aibom.json a local agentaudit run produces. Built from a single ast parse of the agent (never imported or executed); every tool's capability class comes straight from the same classify_tool() the Layer 2 engine uses. See references/aibom_format.md for the CycloneDX-vs-custom-schema decision.

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4c804d4b-968d-5776-87a8-4bf6adf1f0e2",
  "version": 1,
  "metadata": {
    "timestamp": "2026-09-12T20:42:25Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "bom-ref": "agentaudit",
          "name": "AgentAudit",
          "version": "0.1.0"
        }
      ]
    },
    "component": {
      "type": "application",
      "bom-ref": "agent:northwind-support-vulnerable",
      "name": "northwind-support-vulnerable",
      "version": "2ce85c2",
      "description": "Strands agent \u2014 AgentAudit AIBOM",
      "properties": [
        {
          "name": "agentaudit:sourcePath",
          "value": "fixtures/vulnerable_agent.py"
        },
        {
          "name": "agentaudit:sourceSha256",
          "value": "c41d4c1b927d3011523bee732b96448752d171d48b8e3e67d9d1524c216eae3a"
        },
        {
          "name": "agentaudit:framework",
          "value": "strands-agents"
        },
        {
          "name": "agentaudit:toolCount",
          "value": "3"
        },
        {
          "name": "agentaudit:capabilityPairCount",
          "value": "0"
        },
        {
          "name": "agentaudit:systemPromptStaticallyDeterminable",
          "value": "true"
        },
        {
          "name": "agentaudit:modelStaticallyDeterminable",
          "value": "false"
        },
        {
          "name": "agentaudit:deployConfig",
          "value": "fixtures/vulnerable_agent.deploy.json"
        },
        {
          "name": "agentaudit:gitRemote",
          "value": "https://github.com/TOUMO45/AgentAudit"
        },
        {
          "name": "agentaudit:gitCommit",
          "value": "2ce85c205e7e1396719948d27ffda4e50afbff2c"
        },
        {
          "name": "agentaudit:gitBranch",
          "value": "master"
        },
        {
          "name": "agentaudit:gitWorkingTreeDirty",
          "value": "false"
        }
      ]
    }
  },
  "components": [
    {
      "type": "application",
      "bom-ref": "tool:get_account_balance",
      "name": "get_account_balance",
      "description": "Get the balance for a customer account.",
      "properties": [
        {
          "name": "agentaudit:componentKind",
          "value": "agent-tool"
        },
        {
          "name": "agentaudit:definedAt",
          "value": "fixtures/vulnerable_agent.py:35"
        },
        {
          "name": "agentaudit:untrustedParam",
          "value": "account_id"
        }
      ]
    },
    {
      "type": "application",
      "bom-ref": "tool:process_refund",
      "name": "process_refund",
      "description": "Process a small customer refund.",
      "properties": [
        {
          "name": "agentaudit:componentKind",
          "value": "agent-tool"
        },
        {
          "name": "agentaudit:definedAt",
          "value": "fixtures/vulnerable_agent.py:47"
        },
        {
          "name": "agentaudit:untrustedParam",
          "value": "account_id"
        },
        {
          "name": "agentaudit:untrustedParam",
          "value": "amount"
        }
      ]
    },
    {
      "type": "application",
      "bom-ref": "tool:lookup_diagnostic",
      "name": "lookup_diagnostic",
      "description": "Look up a read-only diagnostic record for a support case.",
      "properties": [
        {
          "name": "agentaudit:componentKind",
          "value": "agent-tool"
        },
        {
          "name": "agentaudit:definedAt",
          "value": "fixtures/vulnerable_agent.py:63"
        },
        {
          "name": "agentaudit:untrustedParam",
          "value": "query"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "agent:northwind-support-vulnerable",
      "dependsOn": [
        "tool:get_account_balance",
        "tool:process_refund",
        "tool:lookup_diagnostic"
      ]
    }
  ]
}