How do I install the Security Owasp Agentic skill?

Run npx skillmds@latest add ashermahonin/security-owasp-agentic in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Owasp Agentic safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Owasp Agentic?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Owasp Agentic free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Owasp Agentic?

ashermahonin (@ashermahonin) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Owasp Agentic by ashermahonin

Name: Security Owasp Agentic
Author: ashermahonin

Security Owasp Agentic

Review a tool-using or multi-agent system against the current OWASP Agentic Application risks. Use when an LLM can read, write, execute tools, retain memory, act under an identity, or delegate work. Produce risk status, autonomy and permission boundaries, tool inventory, abuse-case evidence, recovery controls, and a release recommendation.

ashermahonin Updated Sep 21, 2026

File contents

Security: OWASP Agentic AI

Purpose

Treat an agent as a stateful, tool-using actor with broader blast radius than a normal LLM. Walk through the OWASP Top 10 for Agentic Applications, lock the autonomy budget, prove the kill switch works, and only then approve release.

Scope and evidence

Read references/owasp-agentic.md.
Inventory the agent: planner/loop type, memory stores, tools, sub-agents, scopes/credentials per tool, escalation paths, kill switches.
Pull the LLM threat surface from security-owasp-llm and the secrets posture from security-secrets.
Use Context7 MCP for current OWASP Agentic AI guidance and current agent-framework safety patterns (Anthropic Agent SDK, LangChain, LlamaIndex, AutoGen, CrewAI, etc.).

Assessment

For each current ASI category (goal hijack, tool misuse, identity and privilege abuse, agentic supply chain, unexpected code execution, memory/context poisoning, inter-agent communication, cascading failures, human-agent trust exploitation, rogue agents), mark Pass/Concern/Fail/Out-of-scope.
Build an autonomy budget per agent: allowed actions, allowed time, allowed cost, allowed destructive operations, mandatory human-in-the-loop steps.
Verify least privilege per tool: scope, identity, audit trail, revocation path.
Run abuse-case evals: poisoned memory injection, ambiguous goal injection, tool spoofing, RCE-via-tool-output, cascading-loop test, kill-switch trigger test.
Confirm the kill switch: how a user, operator, or monitor can halt the agent within a bounded time; verify by drill.
Produce remediation plan, owner per finding, and release-gate verdict.

Safety rules

Use Context7 MCP for current OWASP Agentic AI categories and current framework safety affordances.
Keep a decision trace: agent architecture, autonomy budget, tool inventory with scopes, eval evidence.
Refuse to approve any agent with destructive tools and no working kill switch.
Escalate before granting any agent access to credentials, payments, public posting, or production write paths.

Security record

Agent architecture diagram (planner, memory, tools, sub-agents, escalation, kill switch)
Autonomy budget table per agent
Tool inventory with scopes, identities, audit, revocation
Per-threat status table with abuse-case eval evidence
Kill-switch drill record
Release-gate verdict

Release criteria

No agent approved without a verified kill switch.
No tool approved beyond least privilege required to complete the smallest user task.
No multi-agent system approved without a cascading-loop test.
No memory store approved without a sanitization or attestation step on read.
No "trust the LLM to refuse" mitigation. Require deterministic enforcement.

Handoff

Hand off to service-implementation for fixes and to qa-eval so the abuse-case suite enters regression. Re-run on every tool-list change.

References

references/owasp-agentic.md: per-threat checklist, autonomy-budget template, kill-switch drill protocol.

---name: security-owasp-agenticdescription: Review a tool-using or multi-agent system against the current OWASP Agentic Application risks. Use when an LLM can read, write, execute tools, retain memory, act under an identity, or delegate work. Produce risk status, autonomy and permission boundaries, tool inventory, abuse-case evidence, recovery controls, and a release recommendation.---# Security: OWASP Agentic AI## PurposeTreat an agent as a stateful, tool-using actor with broader blast radius than a normal LLM. Walk through the OWASP Top 10 for Agentic Applications, lock the autonomy budget, prove the kill switch works, and only then approve release.## Scope and evidence1. Read `references/owasp-agentic.md`.2. Inventory the agent: planner/loop type, memory stores, tools, sub-agents, scopes/credentials per tool, escalation paths, kill switches.3. Pull the LLM threat surface from `security-owasp-llm` and the secrets posture from `security-secrets`.4. Use Context7 MCP for current OWASP Agentic AI guidance and current agent-framework safety patterns (Anthropic Agent SDK, LangChain, LlamaIndex, AutoGen, CrewAI, etc.).## Assessment1. For each current ASI category (goal hijack, tool misuse, identity and privilege abuse, agentic supply chain, unexpected code execution, memory/context poisoning, inter-agent communication, cascading failures, human-agent trust exploitation, rogue agents), mark Pass/Concern/Fail/Out-of-scope.2. Build an autonomy budget per agent: allowed actions, allowed time, allowed cost, allowed destructive operations, mandatory human-in-the-loop steps.3. Verify least privilege per tool: scope, identity, audit trail, revocation path.4. Run abuse-case evals: poisoned memory injection, ambiguous goal injection, tool spoofing, RCE-via-tool-output, cascading-loop test, kill-switch trigger test.5. Confirm the kill switch: how a user, operator, or monitor can halt the agent within a bounded time; verify by drill.6. Produce remediation plan, owner per finding, and release-gate verdict.## Safety rules- Use Context7 MCP for current OWASP Agentic AI categories and current framework safety affordances.- Keep a decision trace: agent architecture, autonomy budget, tool inventory with scopes, eval evidence.- Refuse to approve any agent with destructive tools and no working kill switch.- Escalate before granting any agent access to credentials, payments, public posting, or production write paths.## Security record- Agent architecture diagram (planner, memory, tools, sub-agents, escalation, kill switch)- Autonomy budget table per agent- Tool inventory with scopes, identities, audit, revocation- Per-threat status table with abuse-case eval evidence- Kill-switch drill record- Release-gate verdict## Release criteria- No agent approved without a verified kill switch.- No tool approved beyond least privilege required to complete the smallest user task.- No multi-agent system approved without a cascading-loop test.- No memory store approved without a sanitization or attestation step on read.- No "trust the LLM to refuse" mitigation. Require deterministic enforcement.## HandoffHand off to `service-implementation` for fixes and to `qa-eval` so the abuse-case suite enters regression. Re-run on every tool-list change.## References- `references/owasp-agentic.md`: per-threat checklist, autonomy-budget template, kill-switch drill protocol.

Frequently asked questions