mcpbeat Sign in

Common LLM Security Agent Skill

by HoangNguyen0403

OWASP LLM Top 10 (2025) audit checklist for AI applications, agent tools, RAG pipelines, and prompt construction. Use when performing any security review touching LLM client code, prompt templates, agent tools, or vector stores.

2k tokens
context cost
the whole folder, loaded on every use
2
files
instructions only
0
copies elsewhere
how many repositories repackaged it
536
stars on the repo
on the repository, not the skill itself

Install

one command, takes just this skill from the repository 
npx skills add https://github.com/HoangNguyen0403/agent-skills-standard --skill common-llm-security

What comes with it

5 454 bytes besides the instruction
references/owasp-llm.md

What it tells the agent to use

found in the instruction text
Bash runs shell commands — read the instruction before connecting

The instruction itself

7 sections, as written by the author

OWASP LLM Top 10 Security Checklist (2025)

Priority: P0 (CRITICAL)

Implementation Guidelines

  • Check LLM01 first: Prompt injection #1 LLM finding — any user input concatenated directly into prompt string immediate P0.
  • Check LLM06 next: Agent tools with write/delete/execute capabilities without confirmation P0.
  • Mark each item: ✅ not affected | ⚠️ needs review | 🔴 confirmed finding.
  • P0 finding caps Security score at 40/100 — not skip any item.
  • See references/owasp-llm.md for full detection signals.

OWASP LLM Top 10 (2025)

| ID | Risk | Key Detection Signal |

| ----- | ---- | -------------------- |

| LLM01 | Prompt Injection | User input string-concatenated into prompt. Retrieved docs inserted into system turn. |

| LLM02 | Sensitive Information Disclosure | PII or credentials passed into prompt context. LLM response logged without redaction. |

| LLM03 | Supply Chain | Unverified model weights or plugins. Third-party agent added without trust review. |

| LLM04 | Data & Model Poisoning | User-controlled data written to training sets or embedding stores without validation. |

| LLM05 | Improper Output Handling | LLM output used directly in DOM sink, SQL query, shell command, or redirect URL. |

| LLM06 | Excessive Agency | Agent tool with write/delete/network access — no human-in--loop confirmation. |

| LLM07 | System Prompt Leakage | System prompt content returned via tool output, error message, or API response. |

| LLM08 | Vector & Embedding Weaknesses | User text injected into vector store without sanitization. No tenant namespace isolation. |

| LLM09 | Misinformation | LLM output used for critical decisions (medical, financial, legal) without verification. |

| LLM10 | Unbounded Consumption | No max_tokens on LLM call. No rate limit on invocations. Agent loop without depth cap. |

Anti-Patterns

  • No prompt concat: Pass user input as separate user turn, never interpolated into system prompts.
  • No raw LLM output in sinks: Sanitize LLM responses before writing to DOM, queries, or shell.
  • No uncapped agent loops: Every agentic recursion must enforce max iteration/depth limit.

References

  • OWASP LLM — Full Detection Signals — load when auditing any LLM client code

Canonical response anchors

When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:

  • sanitize

Other skills for the same job

different authors, same section of the catalogue
Security Compliance
by ComeOnOliver
×1

Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.

115k tokens scripts
Imaging Data Commons
by K-Dense-AI

Query and download public cancer imaging data from NCI Imaging Data Commons using idc-index. Use for accessing large-scale radiology (CT, MR, PET) and pathology datasets for AI training or research. No authentication required. Query by metadata, visualize in browser, check licenses.

42k tokens
Hunt LLM AI
by elementalsouls

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection via documents/web pages/email the model reads, ASCII smuggling (Unicode Tags block U+E0000-U+E007F, invisible to humans, decoded by the model), tool-use exfiltration (model has fetch/browse tool, attacker injects OOB URL, model exfils chat history/secrets), markdown-image zero-click exfil, system-prompt extraction, IDOR-via-AI (cross-tenant data). Targets: chatbots, RAG, summarizers, agentic copilots, MCP tools. Detection: any LLM-backed endpoint, doc upload triggering AI processing, autonomous agent with tools. Validate: OOB/Collaborator callback for exfil, verbatim-reproducible system-prompt leak (run twice), verifiable cross-tenant leak or RCE. Confabulation is NOT a finding. Use when hunting AI features, chatbots, RAG, agentic systems, MCP.

4k tokens
Imaging Data Commons
by foryourhealth111-pixel

Query and download public cancer imaging data from NCI Imaging Data Commons using idc-index. Use for accessing large-scale radiology (CT, MR, PET) and pathology datasets for AI training or research. No authentication required. Query by metadata, visualize in browser, check licenses.

33k tokens
Using Model Endpoint
by xuzhougeng

Invoke an already configured model endpoint from a supported Wisp execution context and capture the bounded inference as a Run. Use only when the endpoint URL and authentication are already available inside that context; this skill does not register or manage services.

624 tokens
812 Regulations Eu Product Liability Directive
by jabrena

Use when reviewing, designing, or modifying Java enterprise software products, AI-enabled products, RAG assistants, AI agents, generated instructions, related services, automated updates, vulnerability handling, corrective updates, warnings, instructions, or product-safety evidence under Directive (EU) 2024/2853, the EU Product Liability Directive. Part of Plinth Toolkit

15k tokens
AI Security
by hypnguyen1209

Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)

26k tokens scripts
LLM Security
by semgrep

Security guidelines for LLM applications based on OWASP Top 10 for LLM 2025. Use when building LLM apps, reviewing AI security, implementing RAG systems, or asking about LLM vulnerabilities like 'prompt injection' or 'check LLM security'. IMPORTANT: Always consult this skill when building chatbots, AI agents, RAG pipelines, tool-using LLMs, agentic systems, or any application that calls an LLM API (OpenAI, Anthropic, Gemini, etc.) — even if the user doesn't explicitly mention security. Also use when users import 'openai', 'anthropic', 'langchain', 'llamaindex', or similar LLM libraries.

57k tokens

How to use it

Copy the folder

Take hoangnguyen0403/common-llm-security from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.