OWASP LLM Top 10 Security Checklist (2025)

Priority: P0 (CRITICAL)

Implementation Guidelines

• Check LLM01 first: Prompt injection #1 LLM finding — any user input concatenated directly into prompt string immediate P0.
• Check LLM06 next: Agent tools with write/delete/execute capabilities without confirmation P0.
• Mark each item: ✅ not affected | ⚠️ needs review | 🔴 confirmed finding.
• P0 finding caps Security score at 40/100 — not skip any item.
• See references/owasp-llm.md for full detection signals.
• Agent skill supply chain: Review all package resources; pin source revision and hashes. Treat hashes as integrity, not trusted authorship.
• Memory poisoning: Treat logs, retrieved documents and proposed learning entries as untrusted data; redact before persistence.
• Permission boundaries: Tool/network/filesystem restrictions require host enforcement; skill text and allowed-tools declarations are not universal enforcement.
• Evolution approval: Separate candidate author from approval; block promotion without independent review and verified evidence.
• Offline fallback: Unsupported execution controls block live actions, not safe offline analysis of supplied artifacts.

OWASP LLM Top 10 (2025)

ID	Risk	Key Detection Signal
LLM01	Prompt Injection	User input string-concatenated into prompt. Retrieved docs inserted into system turn.
LLM02	Sensitive Information Disclosure	PII or credentials passed into prompt context. LLM response logged without redaction.
LLM03	Supply Chain	Unverified model weights or plugins. Third-party agent added without trust review.
LLM04	Data & Model Poisoning	User-controlled data written to training sets or embedding stores without validation.
LLM05	Improper Output Handling	LLM output used directly in DOM sink, SQL query, shell command, or redirect URL.
LLM06	Excessive Agency	Agent tool with write/delete/network access — no human-in--loop confirmation.
LLM07	System Prompt Leakage	System prompt content returned via tool output, error message, or API response.
LLM08	Vector & Embedding Weaknesses	User text injected into vector store without sanitization. No tenant namespace isolation.
LLM09	Misinformation	LLM output used for critical decisions (medical, financial, legal) without verification.
LLM10	Unbounded Consumption	No max_tokens on LLM call. No rate limit on invocations. Agent loop without depth cap.

Anti-Patterns

• No prompt concat: Pass user input as separate user turn, never interpolated into system prompts.
• No raw LLM output in sinks: Sanitize LLM responses before writing to DOM, queries, or shell.
• No uncapped agent loops: Every agentic recursion must enforce max iteration/depth limit.

References

• OWASP LLM — Full Detection Signals — load when auditing any LLM client code

Canonical response anchors

When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:

• sanitize