/agent-owasp-compliance

name: agent-owasp-compliance
description: |
  Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks.
  Use this skill when:
  - Evaluating an agent system's security posture before production deployment
  - Running a compliance check against OWASP ASI 2026 standards
  - Mapping existing security controls to the 10 agentic risks
  - Generating a compliance report for security review or audit
  - Comparing agent framework security features against the standard
  - Any request like "is my agent OWASP compliant?", "check ASI compliance", or "agentic security audit"

Agent OWASP ASI Compliance Check

Evaluate AI agent systems against the OWASP Agentic Security Initiative (ASI) Top 10 — the industry standard for agent security posture.

Overview

The OWASP ASI Top 10 defines the critical security risks specific to autonomous AI agents — not LLMs, not chatbots, but agents that call tools, access systems, and act on behalf of users. This skill checks whether your agent implementation addresses each risk.

Codebase → Scan for each ASI control:
  ASI-01: Prompt Injection Protection
  ASI-02: Tool Use Governance
  ASI-03: Agency Boundaries
  ASI-04: Escalation Controls
  ASI-05: Trust Boundary Enforcement
  ASI-06: Logging & Audit
  ASI-07: Identity Management
  ASI-08: Policy Integrity
  ASI-09: Supply Chain Verification
  ASI-10: Behavioral Monitoring
→ Generate Compliance Report (X/10 covered)

The 10 Risks

| Risk | Name | What to Look For | |------|------|-----------------| | ASI-01 | Prompt Injection | Input validation before tool calls, not just LLM output filtering | | ASI-02 | Insecure Tool Use | Tool allowlists, argument validation, no raw shell execution | | ASI-03 | Excessive Agency | Capability boundaries, scope limits, principle of least privilege | | ASI-04 | Unauthorized Escalation | Privilege checks before sensitive operations, no self-promotion | | ASI-05 | Trust Boundary Violation | Trust verification between agents, signed credentials, no blind trust | | ASI-06 | Insufficient Logging | Structured audit trail for all tool calls, tamper-evident logs | | ASI-07 | Insecure Identity | Cryptographic agent identity, not just string names | | ASI-08 | Policy Bypass | Deterministic policy enforcement, no LLM-based permission checks | | ASI-09 | Supply Chain Integrity | Signed plugins/tools, integrity verification, dependency auditing | | ASI-10 | Behavioral Anomaly | Drift detection, circuit breakers, kill switch capability |

---

Check ASI-01: Prompt Injection Protection

Look for input validation that runs **before** tool execution, not after LLM generation.

import re
from pathlib import Path

def check_asi_01(project_path: str) -> dict:
    """ASI-01: Is user input validated before reaching tool execution?"""
    positive_patterns = [
        "input_validation", "validate_input", "sanitize",
        "classify_intent", "prompt_injection", "threat_detect",
        "PolicyEvaluator", "PolicyEngine", "check_content",
    ]
    negative_patterns = [
        r"eval\(", r"exec\(", r"subprocess\.run\(.*shell=True",
        r"os\.system\(",
    ]

    # Scan Python files for signals
    root = Path(project_path)
    positive_matches = []
    negative_matches = []

    for py_file in root.rglob("*.py"):
        content = py_file.read_text(errors="ignore")
        for pattern in positive_patterns:
            if pattern in content:
                positive_matches.append(f"{py_file.name}: {pattern}")
        for pattern in negative_patterns:
            if re.search(pattern, content):
                negative_matches.append(f"{py_file.name}: {pattern}")

    positive_found = len(positive_matches) > 0
    negative_found = len(negative_matches) > 0

    return {
        "risk": "ASI-01",
        "name": "Prompt Injection",
        "status": "pass" if positive_found and not negative_found else "fail",
        "controls_found": positive_matches,
        "vulnerabilities": negative_matches,
        "recommendation": "Add input validation before tool execution, not just output filtering"
    }

**What passing looks like:**

# GOOD: Validate before tool execution
result = policy_engine.evaluate(user_input)
if result.action == "deny":
    return "Request blocked by policy"
tool_result = await execute_tool(validated_input)

**What failing looks like:**

# BAD: User input goes directly to tool
tool_result = await execute_tool(user_input)  # No validation

---

Check ASI-02: Insecure Tool Use

Verify tools have allowlists, argument validation, and no unrestricted execution.

**What to search for:**

• Tool registration with explicit allowlists (not open-ended)
• Argument validation before tool execution
• No `subprocess.run(shell=True)` with user-controlled input
• No `eval()` or `exec()` on agent-generated code without sandbox

**Passing example:**

ALLOWED_TOOLS = {"search", "read_file", "create_ticket"}

def execute_tool(name: str, args: dict):
    if name not in ALLOWED_TOOLS:
        raise PermissionError(f"Tool '{name}' not in allowlist")
    # validate args...
    return tools[name](**validated_args)

---

Check ASI-03: Excessive Agency

Verify agent capabilities are bounded — not open-ended.

**What to search for:**

• Explicit capability lists or execution rings
• Scope limits on what the agent can access
• Principle of least privilege applied to tool access

**Failing:** Agent has access to all tools by default. **Passing:** Agent capabilities defined as a fixed allowlist, unknown tools denied.

---

Check ASI-04: Unauthorized Escalation

Verify agents cannot promote their own privileges.

**What to search for:**

• Privilege level checks before sensitive operations
• No self-promotion patterns (agent changing its own trust score or role)
• Escalation requires external attestation (human or SRE witness)

**Failing:** Agent can modify its own configuration or permissions.