# Agentv Governance

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-entityprocess-agentv-agentv-governance`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [EntityProcess](https://agentstack.voostack.com/s/entityprocess)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [EntityProcess](https://github.com/EntityProcess)
- **Source:** https://github.com/EntityProcess/agentv/tree/main/skills-data/agentv-governance
- **Website:** https://agentv.dev

## Install

```sh
agentstack add skill-entityprocess-agentv-agentv-governance
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# AgentV Compliance Skill

Teaches AI agents how to author syntactically correct `governance:` blocks in AgentV
eval files, and how to lint them against known vocabulary rules.

## Dual mode

**Authoring (interactive):** When a human or AI agent is editing a `*.eval.yaml` file
that contains or should contain a `governance:` block, this skill provides vocabulary,
valid values, and example shapes. Load it alongside `agentv-eval-writer` when building
red-team or compliance suites.

**Linting (non-interactive / CI):** When invoked from a GitHub Action (see
`examples/governance/compliance-lint/`), this skill lints each changed `*.eval.yaml` file
against the rules in `references/lint-rules.md` and returns a structured JSON report.
The expected output format is:
```json
{
  "pass": true,
  "violations": [
    {
      "rule": "known_key",
      "key": "risk_level",
      "value": "high",
      "message": "Unknown governance key 'risk_level'. Did you mean 'risk_tier'?",
      "suggestion": "Replace 'risk_level' with 'risk_tier'."
    }
  ]
}
```
`pass` is `true` when `violations` is empty.

## Reference files

| File | Purpose |
|------|---------|
| `references/governance-yaml-shape.md` | YAML shape, merge semantics, worked examples |
| `references/lint-rules.md` | Machine-readable rules applied during lint |
| `references/owasp-llm-top-10-2025.md` | LLM01–LLM10 canonical IDs and descriptions |
| `references/owasp-agentic-top-10-2025.md` | T01–T10 agentic-AI categories |
| `references/mitre-atlas.md` | Common AML.Txxxx technique IDs |
| `references/eu-ai-act-risk-tiers.md` | Four risk tiers + article references |
| `references/iso-42001-controls.md` | Curated ISO/IEC 42001:2023 controls for AI eval |

## Quick authoring guide

1. Check which risks this eval exercises using the reference files above.
2. Pick IDs from the relevant frameworks (`owasp_llm_top_10_2025`, `mitre_atlas`, etc.).
3. Set `risk_tier` using EU AI Act vocabulary (`prohibited | high | limited | minimal`).
4. Add `controls` as `-:` strings (e.g. `EU-AI-ACT-2024:Art.55`).
5. Run the lint rules from `references/lint-rules.md` against your block before committing.
6. See `references/governance-yaml-shape.md` for complete examples copied from real suites.

## Accessing reference files

To load a specific reference without pulling the entire skill into context:

```bash
agentv skills get agentv-governance --ref lint-rules
```

Or resolve the skill directory and read files directly:

```bash
cat $(agentv skills path agentv-governance)/references/lint-rules.md
```

Use `--full` to retrieve every framework reference in one shot.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [EntityProcess](https://github.com/EntityProcess)
- **Source:** [EntityProcess/agentv](https://github.com/EntityProcess/agentv)
- **License:** MIT
- **Homepage:** https://agentv.dev

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-entityprocess-agentv-agentv-governance
- Seller: https://agentstack.voostack.com/s/entityprocess
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.