llm-risk-assess

Assess LLM applications against the OWASP Top 10 for LLM Applications 2025.

5|1|Updated Mar 5, 2026
One-click install
npx skills add https://github.com/cmaenner/agent-security-playbook --skill llm-risk-assess
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: llm-risk-assess
Source: https://github.com/cmaenner/agent-security-playbook/tree/main/skills/llm-risk-assess
Command: npx skills add https://github.com/cmaenner/agent-security-playbook --skill llm-risk-assess

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the critical security vulnerabilities inherent in Large Language Model (LLM) applications, ensuring robust protection against emerging threats.

Core Features & Use Cases

  • Comprehensive OWASP LLM 2025 Coverage: Assesses applications against all ten categories of the OWASP Top 10 for LLM Applications.
  • Real-world Attack Simulation: Employs realistic attack scenarios to test for prompt injection, data leakage, excessive agency, and more.
  • Use Case: A development team building a new AI-powered customer service chatbot can use this Skill to proactively identify and mitigate risks like prompt injection and sensitive data exposure before deployment.

Quick Start

Assess the security of the LLM application described in the attached document 'llm_app_spec.md'.

Frequently Asked Questions about llm-risk-assess

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure an LLM application against prompt injection and data poisoning?

To secure an LLM application against prompt injection and data poisoning, conduct a comprehensive security assessment against the OWASP Top 10 for LLM Applications 2025 using realistic attack scenarios to identify and mitigate vulnerabilities.

What is the OWASP Top 10 for LLM Applications 2025?

The OWASP Top 10 for LLM Applications 2025 is a security standard covering ten critical vulnerability categories for LLMs, including prompt injection, data leakage, and excessive agency, used to scope comprehensive risk assessments for AI agents and chatbots.

How do I test a RAG pipeline for security vulnerabilities?

You test a RAG pipeline for security vulnerabilities by running comprehensive risk assessments that employ realistic attack scenarios, specifically checking for data poisoning, sensitive data exposure, and prompt injection within the retrieval pipeline.

Does this LLM security assessment cover AI agents and chatbots?

Yes, this LLM security assessment covers AI agents and chatbots, scoping applications against the OWASP Top 10 to identify threats like excessive agency and prompt injection before deployment.

What's the best way to identify excessive agency in AI agents?

The best way to identify excessive agency in AI agents is to conduct a security assessment that employs realistic attack scenarios mapped to the OWASP Top 10 for LLM Applications, revealing where agents overstep intended permissions.

When do I need an LLM risk assessment?

You need an LLM risk assessment when proactively securing LLM applications before deployment, ensuring robust protection against emerging threats like prompt injection and sensitive data exposure in customer service chatbots or RAG pipelines.