Agent skill · security · github
agent-owasp-compliance
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production deployment - Running a compliance check against OWASP ASI 2026 standards - Mapping existing security controls to the 10 agentic risks - Generating a compliance report for security review or audit - Comparing agent framework security features against the standard - Any request like "is my agent OWASP compliant?", "check ASI compliance", or "agentic security audit
Why this skill is useful
Adds specific compliance checks and reporting scripts for OWASP ASI Top 10 risks that the AI wouldn't generate on its own.
What it needs
About 6k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
Agent OWASP ASI Compliance Check Evaluate AI agent systems against the OWASP Agentic Security Initiative (ASI) Top 10 — the industry standard for agent security posture. Overview The OWASP ASI Top 10 defines the critical security risks specific to autonomous AI agents — not LLMs, not chatbots, but agents that call tools, access systems, and act on behalf of users. This skill checks whether your agent implementation addresses each risk. The 10 Risks Risk Name What to Look For ------ ------ ----------------- ASI-01 Prompt Injection Input validation before tool calls, not just LLM output filtering ASI-02 Insecure Tool Use Tool allowlists, argument validation, no raw shell execution ASI-03 Excessive Agency Capability boundaries, scope limits, principle of least privilege ASI-04 Unauthorized Escalation Privilege checks before sensitive operations, no self-promotion ASI-05 Trust Boundary Violation Trust verification between agents, signed credentials, no blind trust ASI-06 Insufficient Logging Structured audit trail for all tool calls, tamper-evident logs ASI-07 Insecure Identity Cryptographic agent identity, not just string names ASI-08 Policy Bypass Deterministic policy enforcement, no LLM-based permission checks ASI-09 Supply Chain Integrity Signed plugins/tools, integrity verification, dependency auditing ASI-10 Behavioral Anomaly Drift detection, circuit breakers, kill switch capability --- Check ASI-01: Prompt Injection Protection Look for input validation that runs before tool execution, not after LLM generation. What passing looks like: What failing looks like: --- Check ASI-02: Insecure Tool Use Verify tools have allowlists, argument validation, and no unrestricted execution. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/agent-owasp-compliance