ai-security

name	ai-security
description	Use when addressing security risks specific to AI and LLM applications. Covers OWASP Top 10 for LLM Applications (2025), prompt injection, model poisoning, excessive agency, insecure output handling, AI red teaming, and responsible AI frameworks. USE FOR: LLM security, prompt injection, model poisoning, excessive agency, AI red teaming, OWASP LLM Top 10, insecure output handling, responsible AI, AI governance, supply chain security for ML models DO NOT USE FOR: general web application security (use owasp), traditional application testing (use security-testing), ML model training and optimization (use AI/ML skills)
license	MIT
metadata	{"displayName":"AI Security","author":"Tyler-R-Kendrick"}
compatibility	claude, copilot, cursor
references	[{"title":"OWASP Top 10 for LLM Applications","url":"https://owasp.org/www-project-top-10-for-large-language-model-applications/"},{"title":"NIST AI Risk Management Framework","url":"https://www.nist.gov/artificial-intelligence/executive-order-safe-secure-and-trustworthy-artificial-intelligence"},{"title":"MITRE ATLAS (Adversarial Threat Landscape for AI Systems)","url":"https://atlas.mitre.org"}]

AI Security

Overview

2025 is the year of LLM agents. As AI systems transition from simple chatbots to autonomous agents capable of executing code, browsing the web, and interacting with APIs, the attack surface expands dramatically. AI introduces novel security challenges that traditional application security frameworks were not designed to address: prompt injection, model poisoning, excessive agency, and supply chain risks unique to machine learning models and training data. Securing AI applications requires specialized security thinking that builds upon — but goes beyond — conventional web application security.

This skill is organized around the OWASP Top 10 for LLM Applications (2025), which provides the authoritative taxonomy of risks specific to large language model applications, supplemented by guidance on AI red teaming methodologies and responsible AI governance frameworks.

OWASP Top 10 for LLM Applications (2025)

#	Risk	Description	Key Mitigations
LLM01	Prompt Injection	Attacker manipulates LLM behavior through crafted input (direct) or poisoned external data (indirect) to bypass instructions, exfiltrate data, or trigger unintended actions	Input validation, privilege separation, output filtering, human-in-the-loop for sensitive actions
LLM02	Sensitive Information Disclosure	LLM reveals confidential data from training data, system prompts, RAG context, or conversation history in its responses	Data sanitization, output filtering, access controls on RAG sources, minimize sensitive data in prompts
LLM03	Supply Chain	Compromised models, poisoned training data, vulnerable plugins, or tampered model artifacts introduce hidden risks	Model provenance verification, SBOM for ML pipelines, dependency scanning, model signing
LLM04	Data and Model Poisoning	Attackers corrupt training or fine-tuning data to introduce backdoors, biases, or malicious behaviors into the model	Data validation and provenance, access controls on training pipelines, anomaly detection, model attestation
LLM05	Improper Output Handling	LLM output is trusted and used directly without validation, enabling injection attacks (XSS, SSRF, command injection) in downstream systems	Treat LLM output as untrusted input, apply output encoding, validate before passing to interpreters or APIs
LLM06	Excessive Agency	LLM is granted more functionality, permissions, or autonomy than necessary, enabling it to take harmful actions