agent-owasp-compliance

1# Agent OWASP ASI Compliance Check
2 
3Evaluate AI agent systems against the OWASP Agentic Security Initiative (ASI) Top 10 — the industry standard for agent security posture.
4 
5## Overview
6 
7The OWASP ASI Top 10 defines the critical security risks specific to autonomous AI agents — not LLMs, not chatbots, but agents that call tools, access systems, and act on behalf of users. This skill checks whether your agent implementation addresses each risk.
8 
9```
10Codebase → Scan for each ASI control:
11  ASI-01: Prompt Injection Protection
12  ASI-02: Tool Use Governance
13  ASI-03: Agency Boundaries
14  ASI-04: Escalation Controls
15  ASI-05: Trust Boundary Enforcement
16  ASI-06: Logging & Audit
17  ASI-07: Identity Management
18  ASI-08: Policy Integrity
19  ASI-09: Supply Chain Verification
20  ASI-10: Behavioral Monitoring
21→ Generate Compliance Report (X/10 covered)
22```
23 
24## The 10 Risks
25 
26| Risk | Name | What to Look For |
27|------|------|-----------------|
28| ASI-01 | Prompt Injection | Input validation before tool calls, not just LLM output filtering |
29| ASI-02 | Insecure Tool Use | Tool allowlists, argument validation, no raw shell execution |
30| ASI-03 | Excessive Agency | Capability boundaries, scope limits, principle of least privilege |
31| ASI-04 | Unauthorized Escalation | Privilege checks before sensitive operations, no self-promotion |
32| ASI-05 | Trust Boundary Violation | Trust verification between agents, signed credentials, no blind trust |
33…