OWASP LLM Top 10 Security Checklist (2025)

Priority: P0 (CRITICAL)

Check LLM01 first: Prompt injection #1 LLM finding — any user input concatenated directly into prompt string immediate P0.
Check LLM06 next: Agent tools with write/delete/execute capabilities without confirmation P0.
Mark each item: ✅ not affected | ⚠️ needs review | 🔴 confirmed finding.
P0 finding caps Security score at 40/100 — not skip any item.
See references/owasp-llm.md for full detection signals.
Agent skill supply chain: Review all package resources; pin source revision and hashes. Treat hashes as integrity, not trusted authorship.
Memory poisoning: Treat logs, retrieved documents and proposed learning entries as untrusted data; redact before persistence.
Permission boundaries: Tool/network/filesystem restrictions require host enforcement; skill text and allowed-tools declarations are not universal enforcement.
Evolution approval: Separate candidate author from approval; block promotion without independent review and verified evidence.
Offline fallback: Unsupported execution controls block live actions, not safe offline analysis of supplied artifacts.