skills.rest
sjinks
sjinksCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-review-owasp-mcp-security

Analyze MCP security risks across code, configuration, and runtime workflows.

Updated Mar 26, 2026
Search Tags:#owasp#mcp#trust-boundaries#security-review#prompt-injection#tool-abuse
One-click install
npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-mcp-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review-owasp-mcp-security
Source: https://github.com/sjinks/ai-owasp-skillset/tree/main/.github/skills/security-review-owasp-mcp-security
Command: npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-mcp-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps reviewers assess MCP-enabled AI systems for security weaknesses that let untrusted content steer model behavior, trigger unsafe tool calls, or expose sensitive context.

Core Features & Use Cases

  • Trust-boundary analysis: Traces how prompts, retrieval, memory, tools, and outputs interact across the system.
  • Abuse-path prioritization: Focuses on prompt injection, tool misuse, data leakage, and unsafe autonomous execution.
  • Evidence-based reporting: Produces confirmed findings, review gaps, passed checks, and a concise overall assessment for security reviews.
  • Use case: Review an assistant that can call external tools and ingest documents to determine whether attacker-controlled content can influence privileged actions.

Quick Start

Use the security-review-owasp-mcp-security skill to assess the attached MCP workflow for prompt injection, tool abuse, and context leakage.

Frequently Asked Questions about security-review-owasp-mcp-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review an MCP workflow for prompt injection and tool abuse risks?▼

You can detect context leakage by tracing how prompts, retrieval, memory, tools, and outputs interact across trust boundaries, generating evidence-based findings that confirm data exposure paths.

What is a trust boundary analysis in AI-assisted systems?▼

Trust boundary analysis traces how prompts, retrieval, memory, tools, and external services interact across security domains, identifying where attacker-controlled content can influence privileged actions or expose sensitive context.

How do I check for unsafe autonomous execution in MCP-enabled assistants?▼

To check for unsafe autonomous execution in MCP-enabled assistants, evaluate code, configuration, and runtime workflows for privileged actions that untrusted content can trigger without proper validation or authorization.

Does this security review cover configuration and architecture or just code?▼

This security review covers code, configuration, architecture, and runtime workflows, assessing how prompts, tools, retrieval, memory, and external services cross trust boundaries to identify security weaknesses comprehensively.

What's the best way to assess external tool calls for security weaknesses in AI systems?▼

The best way to assess external tool calls is prioritizing abuse paths like tool misuse and unsafe autonomous execution, producing evidence-based reports with confirmed findings, passed checks, and severity-ranked remediation.

Related Skills

Explore More Software Engineering Skills→
sjinkssjinks

security-review-owasp-zero-trust-architecture

Identify Zero Trust Architecture weaknesses in code, configuration, and deployment controls.

Community
Advanced
vuminhieuvuminhieu

web-design-guidelines

Audit UI code against Web Interface Guidelines and report file:line findings.

Community
Intermediate
cdalsoniiicdalsoniii

Threat Model

Apply STRIDE threat modeling to system components and data flows.

Community
Advanced
statick88statick88
1

vulnerability-scanning

Automate vulnerability detection across code, dependencies, containers, and infrastructure.

Community
Advanced