agentic-scorecard 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (28) hide show
  1. package/AGENT_PROMPT.md +64 -0
  2. package/LICENSE +201 -0
  3. package/NOTICE +4 -0
  4. package/README.md +191 -0
  5. package/benchmark/mappings/nist-ai-rmf.md +22 -0
  6. package/benchmark/mappings/openssf-scorecard.md +13 -0
  7. package/benchmark/mappings/owasp-agentic.md +16 -0
  8. package/benchmark/v0.1/adapter-contract.md +22 -0
  9. package/benchmark/v0.1/benchmark.yaml +126 -0
  10. package/benchmark/v0.1/controls/context.yaml +43 -0
  11. package/benchmark/v0.1/controls/environment.yaml +74 -0
  12. package/benchmark/v0.1/controls/governance.yaml +53 -0
  13. package/benchmark/v0.1/controls/learning.yaml +40 -0
  14. package/benchmark/v0.1/controls/observability.yaml +54 -0
  15. package/benchmark/v0.1/controls/resilience.yaml +40 -0
  16. package/benchmark/v0.1/controls/security.yaml +64 -0
  17. package/benchmark/v0.1/controls/specification.yaml +42 -0
  18. package/benchmark/v0.1/controls/testing.yaml +42 -0
  19. package/benchmark/v0.1/controls/tooling.yaml +48 -0
  20. package/benchmark/v0.1/evidence-schema.json +28 -0
  21. package/benchmark/v0.1/report-schema.json +32 -0
  22. package/benchmark/v0.1/scoring-policy.md +59 -0
  23. package/dist/cli.js +592 -0
  24. package/package.json +74 -0
  25. package/templates/attestations.yaml +9 -0
  26. package/templates/baseline.csv +1 -0
  27. package/templates/remediation-plan.md +15 -0
  28. package/templates/security-preflight.md +18 -0
package/templates/security-preflight.md ADDED
@@ -0,0 +1,18 @@
1
+ # Agent task security preflight
2
+
3
+ - Task and accountable human:
4
+ - Requested readiness profile:
5
+ - Repository, branch, and allowed paths:
6
+ - Data classification and prohibited data:
7
+ - Allowed read tools:
8
+ - Allowed mutation tools:
9
+ - Credentials and exact scopes:
10
+ - Network destinations:
11
+ - Time, token, and cost budgets:
12
+ - Required verification:
13
+ - Human approvals before high-impact actions:
14
+ - Stop conditions and retry limit:
15
+ - Rollback or recovery owner:
16
+ - Run-record retention and access:
17
+ - Known untrusted-content sources:
18
+ - Exceptions, owner, and expiry: