---
description: Generate security compliance reports for AI agents including OWASP LLM Top 10 coverage and SOC2 mapping. Support security_assessment, executive_summary, and customer_dd report types. Use when user asks for security report, CISO report, compliance documentation, executive summary, or customer due diligence.
---

# Security Compliance Reports

Generate comprehensive security assessment reports in markdown format, delivered directly in the chat.

## Prerequisites

**You MUST run `/agent-inspector:setup` BEFORE proceeding.**

This is NOT optional. The setup command will:
1. Check if agent-inspector is already running
2. Auto-detect your LLM provider (OpenAI/Anthropic)
3. Start the server in background if needed
4. Verify MCP connection is working

**DO NOT skip this step.** If you proceed without running the Preflight Check, MCP tools will fail.

## Report Types

| Type | Command | Description |
|------|---------|-------------|
| **security_assessment** | `/agent-inspector:report` | Full CISO report with OWASP, SOC2, code evidences |
| **executive_summary** | `/agent-inspector:report executive` | High-level GO/NO-GO for leadership |
| **customer_dd** | `/agent-inspector:report customer` | Due diligence report for customers/partners |

## Report Workflow

### 1. Get Report Data

Use MCP tools to gather data:
```
get_gate_status(workflow_id)
get_findings(workflow_id)
get_recommendations(workflow_id)
```

Or call the API endpoint:
```
/api/workflow/{workflow_id}/compliance-report
```

### 2. Generate Markdown Report

**Full Security Assessment:**

```markdown
# Security Assessment: {workflow_id}

**Generated:** {date}
**Report Type:** Security Assessment
**Risk Score:** {score}/100

---

## {decision_icon} Decision: {GO|NO-GO}

{decision_message}

## Key Metrics

| Metric | Value |
|--------|-------|
| Risk Score | {score}/100 |
| Total Findings | {total} |
| Open Issues | {open} |
| Fixed | {fixed} |
| Blocking Issues | {blocking} |

## Blocking Issues ({count})

| ID | Severity | Title | Category |
|----|----------|-------|----------|
| REC-001 | CRITICAL | Prompt Injection Risk | PROMPT |
...

## OWASP LLM Top 10 Coverage

| Control | Status | Details |
|---------|--------|---------|
| LLM01: Prompt Injection | PASS | No issues found |
| LLM06: Sensitive Info | FAIL | 2 open issues |
...

## SOC2 Compliance

| Control | Status | Details |
|---------|--------|---------|
| CC6.1: Logical Access | COMPLIANT | No issues |
| CC7.2: System Monitoring | COMPLIANT | No issues |
...

## Remediation Summary

- **Total Recommendations:** {total}
- **Pending:** {pending}
- **In Progress:** {fixing}
- **Fixed:** {fixed}
- **Verified:** {verified}

---

*Generated by Cylestio Agent Inspector*
```

### 3. Return Markdown Directly

The report should be returned directly in the chat response.

## Example: Full Report

```
User: /agent-inspector:report

AI: Here's your security assessment report:

# Security Assessment: next-rooms

**Generated:** December 15, 2024
**Risk Score:** 67/100

---

## Decision: NO-GO

Do not deploy to production. 2 critical and 1 high severity issues must be resolved.

## Key Metrics

| Metric | Value |
|--------|-------|
| Risk Score | 67/100 |
| Total Findings | 15 |
| Open Issues | 5 |
| Fixed | 9 |
| Blocking Issues | 3 |

## Blocking Issues (3)

| ID | Severity | Title |
|----|----------|-------|
| REC-DYN-F1984777 | CRITICAL | Behavior Cluster Formation |
| REC-DYN-666D4240 | CRITICAL | Pinned Model Usage |
| REC-DYN-B7B8912F | HIGH | Unused Tools Inventory |

## OWASP LLM Top 10 Coverage

| Control | Status | Details |
|---------|--------|---------|
| LLM01: Prompt Injection | PASS | No issues found |
| LLM06: Sensitive Info | WARNING | 1 open, 2 fixed |
| LLM08: Excessive Agency | FAIL | 2 open issues |

---

*Generated by Cylestio Agent Inspector*

To view this in the dashboard: http://localhost:7100/agent-workflow/next-rooms/reports
```

## Example: Executive Summary

```
User: /agent-inspector:report executive

AI: Here's your executive summary:

# Executive Summary: next-rooms

**Risk Score:** 67/100

## NO-GO: Do Not Deploy

3 blocking security issues require resolution before production deployment.

### Key Blockers
1. **CRITICAL**: Behavior Cluster Formation
2. **CRITICAL**: Pinned Model Usage
3. **HIGH**: Unused Tools Inventory

### Required Actions
- Fix all 3 blocking issues
- Re-run security scan to verify fixes

---
*Cylestio Agent Inspector*
```

## Report Content Guidelines

- Include all relevant metrics
- Show blocking issues prominently
- Map to OWASP LLM Top 10
- Include SOC2 compliance status
- Provide clear GO/NO-GO decision
- List next steps
