AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The owasp-llm skill provides a machine-readable implementation of the OWASP Top 10 for LLM Applications (2025). It serves as a comprehensive reference for developers and security professionals to understand, detect, and mitigate vulnerabilities inherent in large language model systems. Each of the ten identified risks is documented with detailed descriptions, risk assessments, vulnerability checklists, and actionable prevention and remediation strategies.
What it does
- Provides a structured index of the 2025 OWASP LLM Top 10 vulnerabilities.
- Offers detailed breakdowns for each vulnerability, including risk impact and attack scenarios.
- Includes specific vulnerability checklists to help identify system exposure.
- Supplies defensive measures and remediation guidance for each security risk.
- Categorizes risks into logical groups like Input Integrity, Data Protection, and Access Control.
When to use it
- During the design phase of an LLM-integrated application to implement security by design.
- When performing a security audit or risk assessment of an existing LLM system.
- To train development teams on common LLM-specific security threats.
- When developing remediation plans for identified security vulnerabilities in AI workflows.
Advantages
- Standardized, industry-recognized framework for LLM security.
- Machine-readable format suitable for integration into automated security agents.
- Covers both direct and indirect attack vectors, including multimodal risks.
- Provides clear, actionable steps for both detection and long-term remediation.
Usage examples
- “What are the primary risks associated with Prompt Injection according to the OWASP LLM Top 10?”
- The agent retrieves the LLM01:2025 documentation, detailing direct and indirect injection risks, potential consequences like data exfiltration, and a checklist for identifying exposure.
- “How can I prevent Excessive Agency in my LLM agent?”
- The agent references LLM06:2025, providing guidance on enforcing least privilege, implementing human-in-the-loop requirements for high-risk actions, and defining strict capability boundaries.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/owasp-llm/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip owasp-llm.zip -d .agents/skills
Documentation by Microsoft
OWASP® LLM Top 10 — Skill Entry
This SKILL.md is the entrypoint for the OWASP LLM Top 10 skill.
The skill encodes the OWASP Top 10 for LLM Applications (2025) as structured, machine-readable references that an agent can query to identify, assess, and remediate security risks in large language model systems.
Normative references (LLM Top 10)
Skill layout
SKILL.md— this file (skill entrypoint).references/— the LLM Top 10 normative documents.00-vulnerability-index.md— index of all vulnerability identifiers, categories, and cross-references.01through10— one document per vulnerability aligned with OWASP LLM Applications numbering.
Third-Party Attribution
Copyright © OWASP Foundation. OWASP® Top 10 for LLM Applications (2025) content is derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Source: https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/ Modifications: Vulnerability descriptions restructured into agent-consumable reference documents with added detection and remediation guidance. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.
Files
- ATTRIBUTION.mdAdded by AutoGineer973 B
- LICENSEAdded by AutoGineer17.9 KiB
- SKILL.md2.5 KiB
- references/00-vulnerability-index.md3.0 KiB
- references/01-prompt-injection.md8.4 KiB
- references/02-sensitive-information-disclosure.md6.8 KiB
- references/03-supply-chain.md6.9 KiB
- references/04-data-and-model-poisoning.md8.0 KiB
- references/05-improper-output-handling.md7.6 KiB
- references/06-excessive-agency.md6.4 KiB
- references/07-system-prompt-leakage.md5.8 KiB
- references/08-vector-and-embedding-weaknesses.md6.2 KiB
- references/09-misinformation.md6.9 KiB
- references/10-unbounded-consumption.md7.4 KiB
references/00-vulnerability-index.md
title: OWASP LLM Top 10 Vulnerability Index description: Index of OWASP Top 10 for LLM Applications (2025) vulnerability identifiers, categories, and cross-references
00 Vulnerability Index
This document provides the index for the OWASP Top 10 for LLM Applications (2025) vulnerabilities. Each entry includes its identifier, title, and primary category.
Vulnerability catalog
| ID | Title | Category |
|---|---|---|
| LLM01:2025 | Prompt Injection | Input Integrity |
| LLM02:2025 | Sensitive Information Disclosure | Data Protection |
| LLM03:2025 | Supply Chain | Supply Chain |
| LLM04:2025 | Data and Model Poisoning | Data Integrity |
| LLM05:2025 | Improper Output Handling | Output Safety |
| LLM06:2025 | Excessive Agency | Access Control |
| LLM07:2025 | System Prompt Leakage | Configuration Security |
| LLM08:2025 | Vector and Embedding Weaknesses | Data Integrity |
| LLM09:2025 | Misinformation | Output Reliability |
| LLM10:2025 | Unbounded Consumption | Resource Management |
Cross-reference matrix
Each vulnerability document follows a consistent structure:
Description — what the vulnerability is and how it manifests in LLM systems.
Risk — concrete consequences of exploitation and business impact.
Vulnerability checklist — indicators that the system is exposed.
Prevention controls — defensive measures and rectification steps.
Example attack scenarios — realistic exploitation narratives.
Detection guidance — signals and methods to identify exposure.
Remediation — immediate and long-term actions to contain and resolve.
Category groupings
Input Integrity
LLM01:2025 Prompt Injection
Data Protection
LLM02:2025 Sensitive Information Disclosure
Supply Chain
LLM03:2025 Supply Chain
Data Integrity
LLM04:2025 Data and Model Poisoning
LLM08:2025 Vector and Embedding Weaknesses
Output Safety
LLM05:2025 Improper Output Handling
Access Control
LLM06:2025 Excessive Agency
Configuration Security
LLM07:2025 System Prompt Leakage
Output Reliability
LLM09:2025 Misinformation
Resource Management
LLM10:2025 Unbounded Consumption
Related OWASP projects
OWASP Top 10 for Agentic Applications (2026) — agentic risks that build upon LLM vulnerabilities.
OWASP Machine Learning Security Top 10 — ML-specific security risks.
OWASP Application Security Verification Standard (ASVS) — general application security controls.
Content derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Modifications: Restructured into agent-consumable reference format with added detection and remediation guidance.
Requirements and compatibility
Written for: GitHub Copilot, Claude Code
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Claude Code frontmatter
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/hve-core · .github/skills/security/owasp-llm · commit f425e94
- Licence
- Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
- LICENSE (written by AutoGineer)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.
Related skills
Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude CodeMITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download owasp-llm.zip