Generate and analyze AI Bill of Materials (AIBOM) for Python projects using AI/ML components.
Identifies AI models, datasets, tools, and frameworks for security and compliance tracking.
Use this skill when:
- User asks to scan for AI components
- User wants to know what AI models a project uses
- User mentions "AI BOM", "AI inventory", or "ML security"
- User is working with Python AI/ML projects (PyTorch, TensorFlow, HuggingFace)
- User needs AI component compliance documentation
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Generate and analyze AI Bill of Materials (AIBOM) for Python projects using AI/ML components.
Identifies AI models, datasets, tools, and frameworks for security and compliance tracking.
Use this skill when:
- User asks to scan for AI components
- User wants to know what AI models a project uses
- User mentions "AI BOM", "AI inventory", or "ML security"
- User is working with Python AI/ML projects (PyTorch, TensorFlow, HuggingFace)
- User needs AI component compliance documentation
allowed-tools
mcp_snyk_snyk_aibom Read Write Bash Grep
license
Apache-2.0
compatibility
Requires Snyk MCP server connection and authenticated Snyk account.
Python projects only. Internet connection required for AIBOM analysis.
Snyk experimental features must be enabled.
metadata
{"author":"Snyk","version":"1.0.0"}
AI Component Inventory
Generate and analyze AI Bill of Materials (AIBOM) for Python projects to track AI models, datasets, and ML frameworks for security, compliance, and governance.
Core Principle: Know what AI components are in your software.
Note: This is an experimental feature. Currently supports Python projects only.
Quick Start
# Step 1: Generate AIBOM for the project
mcp_snyk_snyk_aibom(path="/absolute/path/to/project")
# Step 2: (Optional) Save AIBOM to file for documentation
mcp_snyk_snyk_aibom(
path="/absolute/path/to/project",
json_file_output="/absolute/path/to/output/aibom.json"
)
# Step 3: Verify the returned JSON contains component entries before proceeding
# Step 4: Summarize findings and flag license/risk issues
Prerequisites
Python project with requirements.txt, setup.py, or pyproject.toml
Internet connection (required for analysis)
Snyk experimental features enabled
Phase 1: Project Validation
Goal: Ensure the project is suitable for AI BOM generation.
Step 1.1: Verify Python Project
Check for Python project indicators: requirements.txt, setup.py, pyproject.toml, Pipfile, or .py files.
Error — Not a Python Project: If no Python indicators are found, stop and report:
Verify path contains Python files
Check for requirements.txt or pyproject.toml
This feature only supports Python projects
Step 1.2: Check for AI/ML Indicators
Scan dependency files for known AI/ML packages — common examples include torch, tensorflow, keras, transformers, datasets, scikit-learn, jax, openai, langchain, mlflow, and wandb. This list is illustrative; use judgment for other AI/ML packages encountered.
Step 1.3: Report if Not Applicable
If no AI components detected:
## AI Inventory Result
**Project**: /path/to/project
**Status**: No AI components detected
This project does not appear to use AI/ML frameworks. AI BOM generation is not applicable.
Phase 2: Generate AIBOM
Goal: Create comprehensive AI Bill of Materials.
Step 2.1: Run AIBOM Generation
Invoke the mcp_snyk_snyk_aibom tool with the absolute path to the Python project:
Error — Network Error: If the tool cannot connect, report:
Check internet connection and firewall (HTTPS must be allowed)
Retry after a few minutes
Error — Experimental Feature Not Enabled: If access is denied, report:
Contact Snyk support for experimental access
Check organization settings and verify CLI version supports AIBOM
Step 2.2: Validate AIBOM Output
Before proceeding, verify the returned JSON is valid and contains at least one component entry. If the response is empty or malformed, report the error and do not continue to Phase 3.
Step 2.3: Save Output (Optional)
To persist the AIBOM as a file for documentation or downstream tooling:
Flag components by risk level: Low (MIT, Apache), Medium (proprietary APIs — review terms of service), High (unknown/unclear licenses or research-only terms that may prohibit commercial use).
Step 4.2: Data Privacy Concerns
Flag datasets or models where data provenance or PII handling is unclear. Recommend: documenting data sources, reviewing PII handling procedures, and verifying data retention policies.
