원클릭으로 Manus에서 모든 스킬 실행

$pwd:

ai-inventory

Name: Ai Inventory
Author: snyk

// Generate and analyze AI Bill of Materials (AIBOM) for Python projects using AI/ML components. Identifies AI models, datasets, tools, and frameworks for security and compliance tracking. Use this skill when: - User asks to scan for AI components - User wants to know what AI models a project uses - User mentions "AI BOM", "AI inventory", or "ML security" - User is working with Python AI/ML projects (PyTorch, TensorFlow, HuggingFace) - User needs AI component compliance documentation

Manus에서 실행

$ git log --oneline --stat

stars:40

forks:23

updated:2026년 3월 19일 15:41

SKILL.md

readonly

name	ai-inventory
description	Generate and analyze AI Bill of Materials (AIBOM) for Python projects using AI/ML components. Identifies AI models, datasets, tools, and frameworks for security and compliance tracking. Use this skill when: - User asks to scan for AI components - User wants to know what AI models a project uses - User mentions "AI BOM", "AI inventory", or "ML security" - User is working with Python AI/ML projects (PyTorch, TensorFlow, HuggingFace) - User needs AI component compliance documentation
allowed-tools	mcp_snyk_snyk_aibom Read Write Bash Grep
license	Apache-2.0
compatibility	Requires Snyk MCP server connection and authenticated Snyk account. Python projects only. Internet connection required for AIBOM analysis. Snyk experimental features must be enabled.
metadata	{"author":"Snyk","version":"1.0.0"}

AI Component Inventory

Generate and analyze AI Bill of Materials (AIBOM) for Python projects to track AI models, datasets, and ML frameworks for security, compliance, and governance.

Core Principle: Know what AI components are in your software.

Note: This is an experimental feature. Currently supports Python projects only.

Quick Start

# Step 1: Generate AIBOM for the project
mcp_snyk_snyk_aibom(path="/absolute/path/to/project")

# Step 2: (Optional) Save AIBOM to file for documentation
mcp_snyk_snyk_aibom(
  path="/absolute/path/to/project",
  json_file_output="/absolute/path/to/output/aibom.json"
)

# Step 3: Verify the returned JSON contains component entries before proceeding
# Step 4: Summarize findings and flag license/risk issues

Prerequisites

Python project with requirements.txt, setup.py, or pyproject.toml
Internet connection (required for analysis)
Snyk experimental features enabled

Phase 1: Project Validation

Goal: Ensure the project is suitable for AI BOM generation.

Step 1.1: Verify Python Project

Check for Python project indicators: requirements.txt, setup.py, pyproject.toml, Pipfile, or .py files.

Error — Not a Python Project: If no Python indicators are found, stop and report:

Verify path contains Python files

Check for requirements.txt or pyproject.toml

This feature only supports Python projects

Step 1.2: Check for AI/ML Indicators

Scan dependency files for known AI/ML packages — common examples include torch, tensorflow, keras, transformers, datasets, scikit-learn, jax, openai, langchain, mlflow, and wandb. This list is illustrative; use judgment for other AI/ML packages encountered.

Step 1.3: Report if Not Applicable

If no AI components detected:

## AI Inventory Result
**Project**: /path/to/project
**Status**: No AI components detected
This project does not appear to use AI/ML frameworks. AI BOM generation is not applicable.

Phase 2: Generate AIBOM

Goal: Create comprehensive AI Bill of Materials.

Step 2.1: Run AIBOM Generation

Invoke the mcp_snyk_snyk_aibom tool with the absolute path to the Python project:

mcp_snyk_snyk_aibom(path="/absolute/path/to/project")

Error — Network Error: If the tool cannot connect, report:

Check internet connection and firewall (HTTPS must be allowed)

Retry after a few minutes

Error — Experimental Feature Not Enabled: If access is denied, report:

Contact Snyk support for experimental access

Check organization settings and verify CLI version supports AIBOM

Step 2.2: Validate AIBOM Output

Before proceeding, verify the returned JSON is valid and contains at least one component entry. If the response is empty or malformed, report the error and do not continue to Phase 3.

Step 2.3: Save Output (Optional)

To persist the AIBOM as a file for documentation or downstream tooling:

mcp_snyk_snyk_aibom(
  path="/absolute/path/to/project",
  json_file_output="/absolute/path/to/output/aibom.json"
)

Phase 3: Analyze Components

Goal: Understand and categorize AI components from the validated AIBOM output.

Step 3.1: Component Categories

AIBOM identifies five component types: Models, Datasets, Frameworks, Tools, and Services.

Step 3.2: Generate Summary Report

Present findings using the structure below, populated with actual scan results:

## AI Component Inventory
**Project**: <project name>
**Scan Date**: <date>
**Format**: CycloneDX v1.6

### Component Summary
| Category  | Count |
|-----------|-------|
| AI Models | N     |
| Datasets  | N     |
| Frameworks| N     |
| Tools     | N     |
| **Total** | N     |

### AI Models Detected
| Model | Source | License | Risk |
|-------|--------|---------|------|
| <from scan results> | ... | ... | ... |

### Datasets Referenced
| Dataset | Source | License | PII Risk |
|---------|--------|---------|----------|
| <from scan results> | ... | ... | ... |

### Frameworks & Tools
| Component | Version | License |
|-----------|---------|---------|
| <from scan results> | ... | ... |

Phase 4: Risk Assessment

Goal: Identify potential risks in AI components.

Step 4.1: License Compliance

Flag components by risk level: Low (MIT, Apache), Medium (proprietary APIs — review terms of service), High (unknown/unclear licenses or research-only terms that may prohibit commercial use).

Step 4.2: Data Privacy Concerns

Flag datasets or models where data provenance or PII handling is unclear. Recommend: documenting data sources, reviewing PII handling procedures, and verifying data retention policies.

Step 4.3: Model Security

Assess model-specific risks: prompt injection (LLM-based models — mitigate with input validation), model extraction (custom/fine-tuned models — apply access controls), adversarial inputs (vision models — input validation), and bias/fairness (consider bias testing).

Phase 5: Documentation

Goal: Create compliance-ready documentation.

Step 5.1: Generate Compliance Report

## AI Compliance Report
**Project**: <project name>
**Generated**: <date>
**Standard**: EU AI Act / Internal Governance

### AI System Classification
- **Risk Level**: [High/Limited/Minimal]
- **Category**: [Classification based on use case]

### Component Inventory
[Summary from Phase 3]

### License Compliance
- All components licensed: Yes/No
- Commercial use permitted: Yes/No
- Attribution required: [list components]

### Data Governance
- Data sources documented: Yes/No
- PII handling reviewed: Yes/No
- Consent verified: Yes/No

### Model Governance
- Model cards available: Yes/No
- Bias testing completed: Yes/No
- Performance benchmarks: Yes/No

### Approval Status
- [ ] Technical review
- [ ] Legal review
- [ ] Ethics review
- [ ] Deployment approved

Use Cases

Pre-Deployment Audit: Generate AIBOM → review licenses → check data/PII handling → document for audit trail
Regulatory Compliance (EU AI Act): Generate AIBOM → classify AI system risk level → document capabilities/limitations → create compliance checklist
Third-Party AI Review: Generate AIBOM → analyze licenses → assess data handling → document risks and mitigations

Constraints

Python only: Currently only supports Python projects
Experimental: Feature may change or have limitations
Network required: Needs internet for analysis
CycloneDX output: Generates CycloneDX v1.6 format only
Point-in-time: Reflects current state — regenerate on updates

related-skills.json

같은 저장소

snyk-fix.md

from "snyk/studio-recipes"

Complete security remediation workflow. Scans code for vulnerabilities using Snyk, fixes them, validates the fix, and optionally creates a PR. Supports both single-issue and batch mode for multiple vulnerabilities. Use this skill when: - User asks to fix security vulnerabilities - User mentions "snyk fix", "security fix", or "remediate vulnerabilities" - User wants to fix a specific CVE, Snyk ID, or vulnerability type (XSS, SQL injection, path traversal, etc.) - User wants to upgrade a vulnerable dependency - User asks to "fix all" vulnerabilities or "fix all high/critical" issues (batch mode)

2026-05-1540

container-security.md

from "snyk/studio-recipes"

Comprehensive container image security scanning and remediation. Analyzes Docker images for OS package vulnerabilities, application dependencies, and Dockerfile best practices. Use when: - User asks to scan a Docker image or container - User mentions "container security" or "image vulnerabilities" - User wants to secure a Dockerfile - User asks about base image security - Agent is working with Docker, Kubernetes, or container deployments

2026-03-1940

drift-detector.md

from "snyk/studio-recipes"

Detect infrastructure drift between Terraform state and actual cloud resources. Identifies unmanaged resources, manual changes, and configuration drift. Use when: - User asks to check for infrastructure drift - User wants to find unmanaged cloud resources - User mentions "drift detection" or "Terraform drift" - User asks to compare cloud state to IaC - User wants to audit infrastructure changes

2026-03-1940

iac-security.md

from "snyk/studio-recipes"

Infrastructure as Code security scanning for Terraform, Kubernetes, CloudFormation, and Azure ARM. Detects misconfigurations, security risks, and compliance violations before deployment. Use when: - User asks to scan Terraform files or modules - User mentions "infrastructure security" or "IaC scan" - User is working with Kubernetes manifests - User asks about CloudFormation or ARM template security - Agent is generating or modifying infrastructure code

2026-03-1940

sbom-analyzer.md

from "snyk/studio-recipes"

Software Bill of Materials (SBOM) security analysis for vulnerability assessment and third-party risk management. Validates SBOMs from vendors or generates SBOMs for internal projects. Use this skill when: - User asks to analyze an SBOM file - User mentions "third-party risk" or "vendor security" - User needs to validate a supplier's SBOM - User wants to check SBOM for vulnerabilities - User asks about CycloneDX or SPDX formats

2026-03-1940

secure-at-inception.md

from "snyk/studio-recipes"

Proactive security scanning for newly generated or modified code. Intelligently detects changes, runs appropriate scans (SAST, SCA, IaC), filters to only NEW issues, and prevents vulnerabilities at the source. Use this skill when: - Agent generates new code files - Agent modifies existing code - User asks to "scan for security issues" or "check my changes" - Before committing changes - User mentions "secure at inception", "proactive scan", or "security check"

2026-03-1940

package.json

"author": "snyk"

"repository": "snyk/studio-recipes"

GitHub 저장소 열기 Creator 저장소 보기

$ install --global

$ download --local

Manus에서 실행

$ useful --forSOC

정보 보안 분석가컴퓨터 및 수학직15-1212L4

ai-inventory

AI Component Inventory

Quick Start

Prerequisites

Phase 1: Project Validation

Step 1.1: Verify Python Project

Step 1.2: Check for AI/ML Indicators

Step 1.3: Report if Not Applicable

Phase 2: Generate AIBOM

Step 2.1: Run AIBOM Generation

Step 2.2: Validate AIBOM Output

Step 2.3: Save Output (Optional)

Phase 3: Analyze Components

Step 3.1: Component Categories

Step 3.2: Generate Summary Report

Phase 4: Risk Assessment

Step 4.1: License Compliance

Step 4.2: Data Privacy Concerns

Step 4.3: Model Security

Phase 5: Documentation

Step 5.1: Generate Compliance Report

Use Cases

Constraints

이 저장소의 다른 Skills

이 저장소의 다른 Skills

AI Component Inventory

Quick Start

Prerequisites

Phase 1: Project Validation

Step 1.1: Verify Python Project

Step 1.2: Check for AI/ML Indicators

Step 1.3: Report if Not Applicable

Phase 2: Generate AIBOM

Step 2.1: Run AIBOM Generation

Step 2.2: Validate AIBOM Output

Step 2.3: Save Output (Optional)

Phase 3: Analyze Components

Step 3.1: Component Categories

Step 3.2: Generate Summary Report

Phase 4: Risk Assessment

Step 4.1: License Compliance

Step 4.2: Data Privacy Concerns

Step 4.3: Model Security

Phase 5: Documentation

Step 5.1: Generate Compliance Report

Use Cases

Constraints