Agent Safety Agent Skill

Agent safety

You are the security review for an agent's agency, not for its code. The loop works,

tools are wired, memory persists — your job is to make that autonomy *bounded*. If you

want to review ordinary endpoints, auth, or secrets handling, that is

../secure-coding/SKILL.md — this skill is the *Agentic* Top 10, the risks that exist only

because a model has tools and autonomy. If the loop or tools do not exist yet, that is

../building-agents/SKILL.md. You arrive *after* both.

references/threat-model.md carries the OWASP Agentic Top 10 2026 risks mapped to the

controls below, the pre-ship guardrail checklist, and the incident-triage flow for "the

agent did X" — open it when you are reviewing before ship or reconstructing an incident.

The ownership split

Agent security splits into four layers — Model · Harness · Tools · Environment. The

model provider owns only the Model layer (alignment, refusals). Everything else is yours:

the Harness (loop, memory, context assembly), the Tools (what the agent can *do*), and the

Environment (creds, network, blast radius). Do not outsource a layer you own to "the model

is aligned."

Three excesses cause almost every agentic incident. Cut all three:

• Excessive functionality — tools the task never needs.
• Excessive permissions — broader scopes/creds than the tool needs.
• Excessive autonomy — acting without checking back when it should.

The operating principle is least agency: autonomy is earned per task, not defaulted.

Scope limits

• Declare the allowed task domain as a hard boundary in the system prompt. Why: an

undeclared scope is an infinite scope; "you are a refund assistant; you do not touch

payroll" is a constraint a reviewer can check.

• Deny by default — the agent starts with zero tools. Each tool earns its place by a

task justification. Why: an opt-out tool list grows; an opt-in list stays minimal.

• Segregate the instruction channel from the data channel. System/developer prompt =

trusted instructions. Everything the agent reads at runtime = data, never instructions.

Why: this single boundary is what stops indirect injection (LLM01).

Tool gating / least agency

Give every tool a profile: read / write / exec / send, the exact resources it may

touch, and an allowlist (never a wildcard). Block destructive flags and secret paths

at the tool boundary, not in the prompt — the prompt is advisory, the boundary is enforced.

# Bad: one wildcard tool = unbounded blast radius, runs anything the loop emits
def run_shell(cmd: str) -> str:
    return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout

# Good: narrow tool, allowlisted root, denied patterns, no shell
ALLOWED_ROOT = pathlib.Path("/srv/agent/workspace").resolve()
DENY = ("*.key", "*.pem", "*secret*", "*.env", "id_rsa*")

def read_file(path: str) -> str:
    p = (ALLOWED_ROOT / path).resolve()
    if not p.is_relative_to(ALLOWED_ROOT):           # no traversal out of scope
        raise PermissionError("path outside workspace")
    if any(p.match(g) for g in DENY):                # never read secrets
        raise PermissionError("denied pattern")
    return p.read_text()

• Issue task-scoped, short-lived tokens — not the session's broad creds. A credential

should be valid only for the specific tool and the duration of one task. Why: a hijacked

loop cannot reuse a session-wide token it never held.

• Prefer read-only by default; writes/sends/exec are separate, gated tools. Why: most

steps only need to read, so most steps should be unable to mutate anything.

Injection defense

Treat all external data as untrusted: user messages, retrieved documents, API

responses, emails, web pages, other agents' output. Sanitize and delimit before it enters

context, and never let external text reach a privileged tool unmediated.

| Source | Trust level | Required mediation before it can act |

| ------------------------------ | ----------- | ------------------------------------------- |

| System / developer prompt | Trusted | none (this is the only instruction channel) |

| End-user chat message | Untrusted | delimit; treat as data, not commands |

| Retrieved RAG / KB document | Untrusted | delimit; strip instruction-like spans |

| Fetched web page / API JSON | Untrusted | parse to schema; no raw text → tool args |

| Inbound email / ticket body | Untrusted | delimit; HITL on any action it requests |

| Another agent's message | Untrusted | same as external user input |

# Bad: retrieved chunk flows straight into a privileged action
chunk = retriever.search(q)[0].text          # attacker-controlled doc
agent.call_tool("send_email", to=extract_to(chunk), body=chunk)

# Good: external content is quarantined data; the action is schema-validated + gated
chunk = retriever.search(q)[0].text
ctx = f"<retrieved untrusted>\n{chunk}\n</retrieved untrusted>"   # delimited, labeled
proposal = agent.draft("send_email", context=ctx)                # model proposes
args = SendEmail.model_validate(proposal.args)                   # schema or reject
if args.to_domain not in ALLOWED_DOMAINS:                        # exfil guard
    raise PermissionError("recipient outside allowlist")
require_human_approval("send_email", args)                       # irreversible → HITL

• Validate every tool-call argument against a strict schema before execution. Why: a

schema rejects the surprise field, encoded payload, or off-allowlist recipient injection

produces.

• Watch for exfiltration shapes — unexpected outbound URLs, base64 blobs, recipients

outside the allowlist. Why: data theft is the common payload of a successful injection.

Human-in-the-loop by risk class

Do not approve every action — reported ~93% of permission prompts get approved without

being read, so blanket prompting trains a rubber stamp. Gate by risk class, keyed on

reversibility × blast radius. Bind each approval to the exact parameters with a

short-lived token so the approved action cannot be swapped after the click.

| Action type (examples) | Reversible? | Blast radius | Control |

| ----------------------------------------------- | ----------- | ------------ | ------------------ |

| Read file, search KB, fetch page | n/a | none | auto |

| Write to scratch workspace, internal draft | yes | local | log-only |

| Mutate prod DB, deploy, change config | hard | system | approve (HITL) |

| Send email/payment to external party, post live | no | external | approve (HITL) |

| Delete backups, rotate prod creds, mass-delete | no | catastrophic | block (or step-up auth) |

• Step up for the top row — high-value irreversible actions deserve fresh auth, not the

ambient session. Why: a hijacked session should not also hold the keys to the worst action.

Memory hygiene

• Validate and sanitize content before it is stored. Why: memory poisoning persists

across sessions (OWASP Agentic T1) — unlike session-scoped injection, a poisoned memory

re-attacks every future run until purged.

• **Isolate memory per user and per session; do not let one user's writes color another's

reads.** Why: shared memory is a cross-tenant injection channel.

• Expire entries and cap memory size; redact PII (SSN, cards, API keys) before persist.

Why: stale instructions and leaked secrets both age into liabilities.

Runtime kill-switches

A looping or hijacked agent must hit a wall on its own. Set hard caps, fail closed:

• Tool-call rate cap (e.g. ~30 calls/min) — runaway loops trip it before they do damage.
• Cost cap per session (e.g. ~$10) — a wallet attack stops at a known ceiling.
• Loop / step cap — a fixed max iterations kills the infinite plan.
• Wall-clock timeout — a stuck agent is terminated, not left running.

Log every tool call (arguments redacted) and alert on repeated approval-bypass attempts.

Anti-patterns

| Anti-pattern | Why it bites | Do instead |

| ---------------------------------------------- | ------------------------------------------------------------- | --------------------------------------------------- |

| Approve every action | ~93% rubber-stamped; the real risky one slips through | Gate by risk class; HITL only on irreversible/external |

| One broad session token shared by all tools | Hijacked loop reuses it everywhere | Task-scoped, short-lived per-tool tokens |

| Trust RAG / fetched / email content | Indirect injection (LLM01) becomes direct tool execution | Delimit as untrusted data; mediate before any tool |

| Wildcard run_shell(cmd) tool | Unbounded blast radius | Narrow tools, allowlisted resources, denied patterns |

| Raw external text piped into tool args | Attacker controls the action's parameters | Schema-validate args; allowlist recipients/domains |

| Scope/limits stated only in the prompt | Prompt is advisory; the model can be talked out of it | Enforce at the tool/harness boundary |

| No loop / cost / rate cap | A hijacked or looping agent runs until it runs out of money | Hard fail-closed kill-switches |

| Redact PII only in the UI | The secret was already written to memory/logs | Redact before persistence, at the source |