# Security Owasp Agentic

> Review a tool-using or multi-agent system against the current OWASP Agentic Application risks. Use when an LLM can read, write, execute tools, retain memory, act under an identity, or delegate work. Produce risk status, autonomy and permission boundaries, tool inventory, abuse-case evidence, recovery controls, and a release recommendation.

- Skill: `ashermahonin/security-owasp-agentic` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add ashermahonin/security-owasp-agentic`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ashermahonin/security-owasp-agentic/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: ashermahonin (https://skillmd.com/u/ashermahonin)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/ashermahonin/security-owasp-agentic

---


# Security: OWASP Agentic AI

## Purpose

Treat an agent as a stateful, tool-using actor with broader blast radius than a normal LLM. Walk through the OWASP Top 10 for Agentic Applications, lock the autonomy budget, prove the kill switch works, and only then approve release.

## Scope and evidence

1. Read `references/owasp-agentic.md`.
2. Inventory the agent: planner/loop type, memory stores, tools, sub-agents, scopes/credentials per tool, escalation paths, kill switches.
3. Pull the LLM threat surface from `security-owasp-llm` and the secrets posture from `security-secrets`.
4. Use Context7 MCP for current OWASP Agentic AI guidance and current agent-framework safety patterns (Anthropic Agent SDK, LangChain, LlamaIndex, AutoGen, CrewAI, etc.).

## Assessment

1. For each current ASI category (goal hijack, tool misuse, identity and privilege abuse, agentic supply chain, unexpected code execution, memory/context poisoning, inter-agent communication, cascading failures, human-agent trust exploitation, rogue agents), mark Pass/Concern/Fail/Out-of-scope.
2. Build an autonomy budget per agent: allowed actions, allowed time, allowed cost, allowed destructive operations, mandatory human-in-the-loop steps.
3. Verify least privilege per tool: scope, identity, audit trail, revocation path.
4. Run abuse-case evals: poisoned memory injection, ambiguous goal injection, tool spoofing, RCE-via-tool-output, cascading-loop test, kill-switch trigger test.
5. Confirm the kill switch: how a user, operator, or monitor can halt the agent within a bounded time; verify by drill.
6. Produce remediation plan, owner per finding, and release-gate verdict.

## Safety rules

- Use Context7 MCP for current OWASP Agentic AI categories and current framework safety affordances.
- Keep a decision trace: agent architecture, autonomy budget, tool inventory with scopes, eval evidence.
- Refuse to approve any agent with destructive tools and no working kill switch.
- Escalate before granting any agent access to credentials, payments, public posting, or production write paths.

## Security record

- Agent architecture diagram (planner, memory, tools, sub-agents, escalation, kill switch)
- Autonomy budget table per agent
- Tool inventory with scopes, identities, audit, revocation
- Per-threat status table with abuse-case eval evidence
- Kill-switch drill record
- Release-gate verdict

## Release criteria

- No agent approved without a verified kill switch.
- No tool approved beyond least privilege required to complete the smallest user task.
- No multi-agent system approved without a cascading-loop test.
- No memory store approved without a sanitization or attestation step on read.
- No "trust the LLM to refuse" mitigation. Require deterministic enforcement.

## Handoff

Hand off to `service-implementation` for fixes and to `qa-eval` so the abuse-case suite enters regression. Re-run on every tool-list change.

## References

- `references/owasp-agentic.md`: per-threat checklist, autonomy-budget template, kill-switch drill protocol.