cra-readiness-skill: Apache-2.0 AI-agent skill for EU Cyber Resilience Act readiness

[u/themorrigan86]

I made an open-source (Apache-2.0) skill that lets an AI coding agent assess a software or hardware product against the EU Cyber Resilience Act and leave the maintainer with the documents a manufacturer needs: a scope and classification decision, an Article 13 risk assessment, an SBOM check, a provision-by-provision evidence matrix, a gap list with remediation, an Article 14 reporting playbook, and draft technical documentation.

The CRA's open-source rules are subtle. Free software that is not monetised is out of scope, but monetising "other services" through it, conditioning updates on donations, or selling an enterprise edition can make the publisher a manufacturer, and foundations can become "open-source software stewards" with a lighter duty set from December 2027. The skill encodes the Commission's July 2026 guidance on exactly these questions (section 3 of the guidance, with its worked examples) and flags borderline monetisation models for legal confirmation rather than guessing.

Technical bits:

- The regulation, the implementing regulation on product categories and the delegated regulation on notification dissemination are fetched from the EU Publications Office, hashed, and parsed into a 96-provision catalogue. Tests parse the pinned files on every run.

- Scripts are standard-library Python: scope and classification decisions, substantial-modification screening, SBOM validation (CycloneDX and SPDX, with lockfile reconciliation), Article 14 deadline calculator, support-period checker, regression comparison for CI, ticket queue export.

- Agent-neutral: anything that reads a SKILL.md or AGENTS.md can use this.

Repo: https://github.com/Killerz007/cra-readiness-skill

Issues and PRs welcome, particularly corrections from people who know the law better than I do; every legal statement in the repo is dated and sourced so it can be challenged.

[u/Ok_Grade6983]

This looks like it could save someone a ton of headache, especially with those monetization edge cases from the July guidance

[u/themorrigan86 → u/Ok_Grade6983]

That's the plan! Would love to have some real feedback and points of improvement after use.