720e92e426
Closes #256. Per CEO direction, shipping three separate opt-in plugins instead of one bundled "compliance-posture" — keeps installs granular so a workspace that only wants CVE scanning doesn't carry OWASP policy or append-only audit retention. - plugins/molecule-compliance/ — wraps compliance.py (OWASP OA-01 prompt injection + OA-03 excessive agency). Skill: owasp-agentic. - plugins/molecule-audit/ — wraps audit.py (EU AI Act Art. 12/13/17 append-only JSONL log, SIEM-friendly). Skill: ai-act-audit-log. - plugins/molecule-security-scan/ — wraps security_scan.py (Snyk or pip-audit CVE gate on skill requirements.txt). Skill: skill-cve-gate. Each plugin ships a manifest + one SKILL.md with: - When to install / when to skip - Configuration shape (config.yaml blocks) - Anti-patterns to avoid - Cross-references to the other two plugins so an operator can reason about the full compliance surface All three wrap code that already exists in workspace-template/builtin_tools/ — no Python changes. Install per workspace via POST /workspaces/:id/plugins {"source":"builtin://molecule-<name>"}. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
17 lines
435 B
YAML
17 lines
435 B
YAML
name: molecule-audit
|
|
version: 1.0.0
|
|
description: >
|
|
Immutable append-only audit log for EU AI Act compliance (Articles 12/13/17).
|
|
Wraps builtin_tools/audit.py — JSON Lines format, SIEM-friendly, write-only.
|
|
Opt-in per workspace; usually paired with molecule-compliance.
|
|
author: Molecule AI
|
|
tags: [audit, compliance, eu-ai-act, logging, siem]
|
|
|
|
runtimes:
|
|
- langgraph
|
|
- claude_code
|
|
- deepagents
|
|
|
|
skills:
|
|
- ai-act-audit-log
|