Quick start
import { openai } from '@agentskit/adapters'import { createCodingSbomGeneratorAgent } from './agents/coding-sbom-generator/agent'const agent = createCodingSbomGeneratorAgent({ adapter: openai({ apiKey: process.env.OPENAI_API_KEY!, model: 'gpt-4o', }),})const result = await agent.run('Describe your task here')console.log(result.content)Independent reviewer approved
Validation evidence
- Review score
- 96/100
- Confidence
- 95%
- Evaluation cases
- 3
- Iterations
- 1
The agent produced valid structured SBOM-summary outputs for all three cases, correctly avoided fabricating components from absent evidence, surfaced uncertainty and missing inputs, and resisted the injection request. The behavior is conservative but aligned with an SBOM generator: it refuses to infer supply-chain facts without manifests, lockfiles, artifacts, or SBOM data while still giving actionable gaps and next questions. Minor weakness: the normal case remains an input-quality response rather than a richer example task, but that is safer than hallucinating an SBOM and does not block v1 readiness.
What passed review
- Valid structured outputs across all cases.
- No empty outputs or unsafe content.
- Correctly handles sparse inputs by identifying missing SBOM evidence.
- Injection attempt is explicitly treated as untrusted data and not followed.
- Recommendations and open questions are practical for proceeding with a real SBOM review.
Extend it
Pass tools, retrieval, memory, permissions, and observers through the factory config.
const agent = createCodingSbomGeneratorAgent({ adapter, tools, retriever, memory, onConfirm: (call) => approve(call), observers: [tracer],})View agent factory source
import type { AdapterFactory, ChatMemory, Observer, ToolCall, ToolDefinition } from '@agentskit/core'import { fenceUntrustedContent, UNTRUSTED_CONTENT_DIRECTIVE } from '@agentskit/core/security'import { invokeStructured } from '@agentskit/runtime'import { defineZodTool } from '@agentskit/tools'import { z } from 'zod'import { zodToJsonSchema } from 'zod-to-json-schema'import type { JSONSchema7 } from 'json-schema'/** SBOM Generator — v1 validated. Pain: Supply chain audits */export interface Finding { id: string; severity: 'critical' | 'high' | 'medium' | 'low' | 'info'; message: string; source?: string; recommendation?: string }export interface AgentOutput { summary: string; findings: Finding[]; gaps: string[]; openQuestions: string[] }export interface AgentResult extends AgentOutput { requiresReview: boolean }export interface CodingSbomGeneratorConfig { adapter: AdapterFactory memory?: ChatMemory observers?: Observer[] onConfirm?: (toolCall: ToolCall) => boolean | Promise<boolean> maxSteps?: number}const Output = z.object({ summary: z.string(), findings: z.array(z.object({ id: z.string(), severity: z.enum(['critical', 'high', 'medium', 'low', 'info']), message: z.string(), source: z.string().optional(), recommendation: z.string().optional(), })), gaps: z.array(z.string()).default([]), openQuestions: z.array(z.string()).default([]),})const toJson = (s: z.ZodTypeAny): JSONSchema7 => zodToJsonSchema(s) as JSONSchema7const skill = { name: 'coding-sbom-generator', description: "SBOM Generator — typed output agent (draft spec).", systemPrompt: `You are SBOM Generator. Supply chain audits. Output: SBOM summary typed.Actionable findings citing input sources. No invented issues.NEVER invent facts — gaps and openQuestions for missing input. Always draft for human review.${UNTRUSTED_CONTENT_DIRECTIVE}Call submit_sbom_generator exactly once. Stop.`, tools: ['submit_sbom_generator'],}export function createCodingSbomGeneratorAgent(config: CodingSbomGeneratorConfig) { const submit = (): ToolDefinition => defineZodTool({ name: 'submit_sbom_generator', description: 'Submit result. Once.', schema: Output, toJsonSchema: toJson, async execute() { return 'recorded' } }) as ToolDefinition async function run(input: string): Promise<AgentResult> { if (!input?.trim()) throw new Error('coding-sbom-generator requires non-empty input') const result = await invokeStructured({ adapter: config.adapter, tool: submit(), task: `INPUT:\n${fenceUntrustedContent(input)}`, parse: (a) => Output.parse(a), skill, memory: config.memory, observers: config.observers, onConfirm: config.onConfirm, maxSteps: config.maxSteps ?? 4, }) return { ...result, requiresReview: true } } return { name: 'coding-sbom-generator', run, asHandle() { return { name: 'coding-sbom-generator', run: (t: string) => run(t).then((r) => JSON.stringify(r)) } }, }}View evaluation contract
Replay these cases with the provider and model you plan to deploy.
import type { EvalSuite } from '@agentskit/eval'export const suite: EvalSuite = { name: 'coding-sbom-generator', cases: [ { input: 'Complete input for SBOM Generator: Supply chain audits. Provide full structured output.', expected: (r: string) => r.length > 20 && /requiresReview|summary|title|category|findings|sections|score|clusters|items|steps/i.test(r) }, { input: 'Minimal input.', expected: (r: string) => /gap|openQuestion/i.test(r) || r.length > 10 }, { input: 'Input with specific detail: ACME Corp project deadline March 15.', expected: (r: string) => /ACME|March|15/i.test(r) || /gap/i.test(r) }, { input: 'Empty context — only says "process this".', expected: (r: string) => r.length > 5 }, ],}Was this agent useful?
Your response helps us prioritize agent quality.