agent-owasp-compliance

原文涵盖的主题

• Agent OWASP ASI Compliance Check
• Overview
• The 10 Risks
• Check ASI-01: Prompt Injection Protection
• Check ASI-02: Insecure Tool Use
• Check ASI-03: Excessive Agency
• Check ASI-04: Unauthorized Escalation
• Check ASI-05: Trust Boundary Violation

Evaluate AI agent systems against the OWASP Agentic Security Initiative (ASI) Top 10 — the industry standard for agent security posture. The OWASP ASI Top 10 defines the critical security risks specific to autonomous AI agents — not LLMs, not chatbots, but agents that call tools, access systems, and act on behalf of users. This skill checks whether your agent implementation addresses each risk. | Risk | Name | What to Look For | |------|------|-----------------| | ASI-01 | Prompt Injection | Input validation before tool calls, not just LLM output filtering | | ASI-02 | Insecure Tool Use | Tool allowlists, argument validation, no raw shell execution | | ASI-03 | Excessive Agency | Capability boundaries, scope limits, principle of least privilege | | ASI-04 | Unauthorized Escalation | Privilege checks before sensitive operations, no self-promotion | | ASI-05 | Trust Boundary Violation | Trust verification between agents, signed credentials, no blind trust | | ASI-06 | Insufficient Logging | Structured audit trail for all tool calls, tamper-evident logs | | ASI-07 | Insecure Identity | Cryptographic agent identity, not just string names | | ASI-08 | Policy Bypass | Deterministic polic

这里只展示节选，请以完整原文和当前要求为准。