# Security Owasp LLM

> Review an LLM, RAG, embedding, fine-tuning, or model-routed feature against the current OWASP LLM risks. Use when untrusted content enters prompts or retrieval, model output affects another system, sensitive data is exposed to a provider, or cost and agency can grow. Produce a data-flow threat model, abuse-case evidence, controls, residual risk, and release recommendation.

- Skill: `ashermahonin/security-owasp-llm` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add ashermahonin/security-owasp-llm`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ashermahonin/security-owasp-llm/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: ashermahonin (https://skillmd.com/u/ashermahonin)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/ashermahonin/security-owasp-llm

---


# Security: OWASP LLM Top 10

## Purpose

Map the LLM data flow and review each applicable OWASP LLM category with concrete abuse cases. The release verdict must rely on tests and controls, not expected model behaviour.

## Scope and evidence

1. Read `references/owasp-llm-top10.md`.
2. Map the LLM data flow: user input → preprocessing → prompt assembly → retrieval/embedding → model call → output handling → downstream effect. Note where untrusted data crosses into prompt context.
3. Identify the model(s), provider(s), tool(s), and the agent's permitted actions.
4. Use Context7 MCP for the current OWASP LLM Top 10 wording and the current model-provider security guidance (Anthropic, OpenAI, Google, Mistral, Meta, etc.).

## Assessment

1. For each LLM Top 10 category, mark status: Pass / Concern / Fail / Out-of-scope.
2. Build an abuse-case list per category: e.g., direct prompt injection, indirect via retrieved doc, system-prompt leakage probe, jailbreak via tool description, exfil via embedding inversion, denial via context blow-up.
3. Verify each abuse case with an eval: at least 10 representative prompts per category, multiple seeds, varied phrasing, plus at least one obfuscated/encoded variant.
4. Cross-check with `security-owasp-agentic` for autonomy/agency risk and with `security-secrets` for prompt content secrets handling.
5. Produce remediation plan, owner per finding, and a release-gate verdict with conditions.

## Safety rules

- Use Context7 MCP for current LLM Top 10 categories, provider safety docs, and any model-card limitations.
- Keep a decision trace: model version, evaluator method, abuse-case coverage, what is not yet tested.
- Refuse to mark a category Pass without an eval run, not just a code review.
- Escalate any unmitigated Excessive Agency or Sensitive Information Disclosure finding before release.

## Security record

- LLM data-flow diagram (sources, sinks, trust boundaries)
- Per-category status table with eval evidence
- Abuse-case eval results (counts, rates, examples)
- Findings register with owners
- Release-gate verdict and conditions

## Release criteria

- No category marked Pass from prompt review alone; require eval evidence.
- No mitigation that relies on "the model usually refuses". Require deterministic guardrail evidence.
- No retrieval pipeline approved without an injection test through ingested content.
- No tool-using agent approved without an excessive-agency review.

## Handoff

Hand off to `service-implementation` per finding and to `qa-eval` to add the abuse-case evals into the regression suite.

## References

- `references/owasp-llm-top10.md`: per-category checklist, abuse-case patterns, and provider-specific notes.