How do I install the Security Owasp LLM skill?

Run npx skillmds@latest add ashermahonin/security-owasp-llm in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Owasp LLM safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Owasp LLM?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Owasp LLM free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Owasp LLM?

ashermahonin (@ashermahonin) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Owasp LLM by ashermahonin — Agent Skill

Name: Security Owasp LLM
Author: ashermahonin

Security Owasp LLM

Review an LLM, RAG, embedding, fine-tuning, or model-routed feature against the current OWASP LLM risks. Use when untrusted content enters prompts or retrieval, model output affects another system, sensitive data is exposed to a provider, or cost and agency can grow. Produce a data-flow threat model, abuse-case evidence, controls, residual risk, and release recommendation.

ashermahonin Updated Sep 21, 2026

File contents

Security: OWASP LLM Top 10

Purpose

Map the LLM data flow and review each applicable OWASP LLM category with concrete abuse cases. The release verdict must rely on tests and controls, not expected model behaviour.

Scope and evidence

Read references/owasp-llm-top10.md.
Map the LLM data flow: user input → preprocessing → prompt assembly → retrieval/embedding → model call → output handling → downstream effect. Note where untrusted data crosses into prompt context.
Identify the model(s), provider(s), tool(s), and the agent's permitted actions.
Use Context7 MCP for the current OWASP LLM Top 10 wording and the current model-provider security guidance (Anthropic, OpenAI, Google, Mistral, Meta, etc.).

Assessment

For each LLM Top 10 category, mark status: Pass / Concern / Fail / Out-of-scope.
Build an abuse-case list per category: e.g., direct prompt injection, indirect via retrieved doc, system-prompt leakage probe, jailbreak via tool description, exfil via embedding inversion, denial via context blow-up.
Verify each abuse case with an eval: at least 10 representative prompts per category, multiple seeds, varied phrasing, plus at least one obfuscated/encoded variant.
Cross-check with security-owasp-agentic for autonomy/agency risk and with security-secrets for prompt content secrets handling.
Produce remediation plan, owner per finding, and a release-gate verdict with conditions.

Safety rules

Use Context7 MCP for current LLM Top 10 categories, provider safety docs, and any model-card limitations.
Keep a decision trace: model version, evaluator method, abuse-case coverage, what is not yet tested.
Refuse to mark a category Pass without an eval run, not just a code review.
Escalate any unmitigated Excessive Agency or Sensitive Information Disclosure finding before release.

Security record

LLM data-flow diagram (sources, sinks, trust boundaries)
Per-category status table with eval evidence
Abuse-case eval results (counts, rates, examples)
Findings register with owners
Release-gate verdict and conditions

Release criteria

No category marked Pass from prompt review alone; require eval evidence.
No mitigation that relies on "the model usually refuses". Require deterministic guardrail evidence.
No retrieval pipeline approved without an injection test through ingested content.
No tool-using agent approved without an excessive-agency review.

Handoff

Hand off to service-implementation per finding and to qa-eval to add the abuse-case evals into the regression suite.

References

references/owasp-llm-top10.md: per-category checklist, abuse-case patterns, and provider-specific notes.

---name: security-owasp-llmdescription: Review an LLM, RAG, embedding, fine-tuning, or model-routed feature against the current OWASP LLM risks. Use when untrusted content enters prompts or retrieval, model output affects another system, sensitive data is exposed to a provider, or cost and agency can grow. Produce a data-flow threat model, abuse-case evidence, controls, residual risk, and release recommendation.---# Security: OWASP LLM Top 10## PurposeMap the LLM data flow and review each applicable OWASP LLM category with concrete abuse cases. The release verdict must rely on tests and controls, not expected model behaviour.## Scope and evidence1. Read `references/owasp-llm-top10.md`.2. Map the LLM data flow: user input → preprocessing → prompt assembly → retrieval/embedding → model call → output handling → downstream effect. Note where untrusted data crosses into prompt context.3. Identify the model(s), provider(s), tool(s), and the agent's permitted actions.4. Use Context7 MCP for the current OWASP LLM Top 10 wording and the current model-provider security guidance (Anthropic, OpenAI, Google, Mistral, Meta, etc.).## Assessment1. For each LLM Top 10 category, mark status: Pass / Concern / Fail / Out-of-scope.2. Build an abuse-case list per category: e.g., direct prompt injection, indirect via retrieved doc, system-prompt leakage probe, jailbreak via tool description, exfil via embedding inversion, denial via context blow-up.3. Verify each abuse case with an eval: at least 10 representative prompts per category, multiple seeds, varied phrasing, plus at least one obfuscated/encoded variant.4. Cross-check with `security-owasp-agentic` for autonomy/agency risk and with `security-secrets` for prompt content secrets handling.5. Produce remediation plan, owner per finding, and a release-gate verdict with conditions.## Safety rules- Use Context7 MCP for current LLM Top 10 categories, provider safety docs, and any model-card limitations.- Keep a decision trace: model version, evaluator method, abuse-case coverage, what is not yet tested.- Refuse to mark a category Pass without an eval run, not just a code review.- Escalate any unmitigated Excessive Agency or Sensitive Information Disclosure finding before release.## Security record- LLM data-flow diagram (sources, sinks, trust boundaries)- Per-category status table with eval evidence- Abuse-case eval results (counts, rates, examples)- Findings register with owners- Release-gate verdict and conditions## Release criteria- No category marked Pass from prompt review alone; require eval evidence.- No mitigation that relies on "the model usually refuses". Require deterministic guardrail evidence.- No retrieval pipeline approved without an injection test through ingested content.- No tool-using agent approved without an excessive-agency review.## HandoffHand off to `service-implementation` per finding and to `qa-eval` to add the abuse-case evals into the regression suite.## References- `references/owasp-llm-top10.md`: per-category checklist, abuse-case patterns, and provider-specific notes.

Frequently asked questions