Skip to content

Commit df975a3

Browse files
imran-siddiqueCopilot
imran-siddique
and
Copilot
committed
feat: add 3 agent security skills (MCP audit, OWASP compliance, supply chain)
- mcp-security-audit: Audit .mcp.json files for hardcoded secrets, shell injection, unpinned versions, dangerous command patterns - agent-owasp-compliance: Check agent systems against OWASP ASI 2026 Top 10 risks with compliance report generation - agent-supply-chain: SHA-256 integrity manifests, tamper detection, version pinning audit, promotion gates for agent plugins Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 6cc49fc commit df975a3

File tree

3 files changed

+829
-0
lines changed

3 files changed

+829
-0
lines changed

‎skills/agent-owasp-compliance/SKILL.md‎

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
---
2+
name: agent-owasp-compliance
3+
description: |
4+
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks.
5+
Use this skill when:
6+
- Evaluating an agent system's security posture before production deployment
7+
- Running a compliance check against OWASP ASI 2026 standards
8+
- Mapping existing security controls to the 10 agentic risks
9+
- Generating a compliance report for security review or audit
10+
- Comparing agent framework security features against the standard
11+
- Any request like "is my agent OWASP compliant?", "check ASI compliance", or "agentic security audit"
12+
---
13+
14+
# Agent OWASP ASI Compliance Check
15+
16+
Evaluate AI agent systems against the OWASP Agentic Security Initiative (ASI) Top 10 — the industry standard for agent security posture.
17+
18+
## Overview
19+
20+
The OWASP ASI Top 10 defines the critical security risks specific to autonomous AI agents — not LLMs, not chatbots, but agents that call tools, access systems, and act on behalf of users. This skill checks whether your agent implementation addresses each risk.
21+
22+
```
23+
Codebase → Scan for each ASI control:
24+
ASI-01: Prompt Injection Protection
25+
ASI-02: Tool Use Governance
26+
ASI-03: Agency Boundaries
27+
ASI-04: Escalation Controls
28+
ASI-05: Trust Boundary Enforcement
29+
ASI-06: Logging & Audit
30+
ASI-07: Identity Management
31+
ASI-08: Policy Integrity
32+
ASI-09: Supply Chain Verification
33+
ASI-10: Behavioral Monitoring
34+
→ Generate Compliance Report (X/10 covered)
35+
```
36+
37+
## The 10 Risks
38+
39+
| Risk | Name | What to Look For |
40+
|------|------|-----------------|
41+
| ASI-01 | Prompt Injection | Input validation before tool calls, not just LLM output filtering |
42+
| ASI-02 | Insecure Tool Use | Tool allowlists, argument validation, no raw shell execution |
43+
| ASI-03 | Excessive Agency | Capability boundaries, scope limits, principle of least privilege |
44+
| ASI-04 | Unauthorized Escalation | Privilege checks before sensitive operations, no self-promotion |
45+
| ASI-05 | Trust Boundary Violation | Trust verification between agents, signed credentials, no blind trust |
46+
| ASI-06 | Insufficient Logging | Structured audit trail for all tool calls, tamper-evident logs |
47+
| ASI-07 | Insecure Identity | Cryptographic agent identity, not just string names |
48+
| ASI-08 | Policy Bypass | Deterministic policy enforcement, no LLM-based permission checks |
49+
| ASI-09 | Supply Chain Integrity | Signed plugins/tools, integrity verification, dependency auditing |
50+
| ASI-10 | Behavioral Anomaly | Drift detection, circuit breakers, kill switch capability |
51+
52+
---
53+
54+
## Check ASI-01: Prompt Injection Protection
55+
56+
Look for input validation that runs **before** tool execution, not after LLM generation.
57+
58+
```python
59+
def check_asi_01(project_path: str) -> dict:
60+
"""ASI-01: Is user input validated before reaching tool execution?"""
61+
signals = {
62+
"positive": [
63+
"input_validation", "validate_input", "sanitize",
64+
"classify_intent", "prompt_injection", "threat_detect",
65+
"PolicyEvaluator", "PolicyEngine", "check_content",
66+
],
67+
"negative": [
68+
"eval(", "exec(", "subprocess.run(.*shell=True",
69+
"os.system(", "input()", # raw input passed to tools
70+
]
71+
}
72+
# Search codebase for these patterns
73+
# Positive signals = controls exist
74+
# Negative signals = potential vulnerabilities
75+
return {
76+
"risk": "ASI-01",
77+
"name": "Prompt Injection",
78+
"status": "pass" if positive_found and not negative_found else "fail",
79+
"controls_found": positive_matches,
80+
"vulnerabilities": negative_matches,
81+
"recommendation": "Add input validation before tool execution, not just output filtering"
82+
}
83+
```
84+
85+
**What passing looks like:**
86+
```python
87+
# GOOD: Validate before tool execution
88+
result = policy_engine.evaluate(user_input)
89+
if result.action == "deny":
90+
return "Request blocked by policy"
91+
tool_result = await execute_tool(validated_input)
92+
```
93+
94+
**What failing looks like:**
95+
```python
96+
# BAD: User input goes directly to tool
97+
tool_result = await execute_tool(user_input) # No validation
98+
```
99+
100+
---
101+
102+
## Check ASI-02: Insecure Tool Use
103+
104+
Verify tools have allowlists, argument validation, and no unrestricted execution.
105+
106+
**What to search for:**
107+
- Tool registration with explicit allowlists (not open-ended)
108+
- Argument validation before tool execution
109+
- No `subprocess.run(shell=True)` with user-controlled input
110+
- No `eval()` or `exec()` on agent-generated code without sandbox
111+
112+
**Passing example:**
113+
```python
114+
ALLOWED_TOOLS = {"search", "read_file", "create_ticket"}
115+
116+
def execute_tool(name: str, args: dict):
117+
if name not in ALLOWED_TOOLS:
118+
raise PermissionError(f"Tool '{name}' not in allowlist")
119+
# validate args...
120+
return tools[name](**validated_args)
121+
```
122+
123+
---
124+
125+
## Check ASI-05: Trust Boundary Violation
126+
127+
In multi-agent systems, verify that agents verify each other's identity before accepting instructions.
128+
129+
**What to search for:**
130+
- Agent identity verification (DIDs, signed tokens, API keys)
131+
- Trust score checks before accepting delegated tasks
132+
- No blind trust of inter-agent messages
133+
- Delegation narrowing (child scope <= parent scope)
134+
135+
**Passing example:**
136+
```python
137+
def accept_task(sender_id: str, task: dict):
138+
trust = trust_registry.get_trust(sender_id)
139+
if not trust.meets_threshold(0.7):
140+
raise PermissionError(f"Agent {sender_id} trust too low: {trust.current()}")
141+
if not verify_signature(task, sender_id):
142+
raise SecurityError("Task signature verification failed")
143+
return process_task(task)
144+
```
145+
146+
---
147+
148+
## Check ASI-07: Insecure Identity
149+
150+
Verify agents have cryptographic identity, not just string names.
151+
152+
**Failing indicators:**
153+
- Agent identified by `agent_name = "my-agent"` (string only)
154+
- No authentication between agents
155+
- Shared credentials across agents
156+
157+
**Passing indicators:**
158+
- DID-based identity (`did:web:`, `did:key:`)
159+
- Ed25519 or similar cryptographic signing
160+
- Per-agent credentials with rotation
161+
- Identity bound to specific capabilities
162+
163+
---
164+
165+
## Check ASI-09: Supply Chain Integrity
166+
167+
Verify agent plugins and tools have integrity verification.
168+
169+
**What to search for:**
170+
- `INTEGRITY.json` or manifest files with SHA-256 hashes
171+
- Signature verification on plugin installation
172+
- Dependency pinning (no `@latest`, `>=` without upper bound)
173+
- SBOM generation
174+
175+
---
176+
177+
## Compliance Report Format
178+
179+
```markdown
180+
# OWASP ASI Compliance Report
181+
Generated: 2026-04-01
182+
Project: my-agent-system
183+
184+
## Summary: 7/10 Controls Covered
185+
186+
| Risk | Status | Finding |
187+
|------|--------|---------|
188+
| ASI-01 Prompt Injection | PASS | PolicyEngine validates input before tool calls |
189+
| ASI-02 Insecure Tool Use | PASS | Tool allowlist enforced in governance.py |
190+
| ASI-03 Excessive Agency | PASS | Execution rings limit capabilities |
191+
| ASI-04 Unauthorized Escalation | PASS | Ring promotion requires attestation |
192+
| ASI-05 Trust Boundary | FAIL | No identity verification between agents |
193+
| ASI-06 Insufficient Logging | PASS | AuditChain with SHA-256 chain hashes |
194+
| ASI-07 Insecure Identity | FAIL | Agents use string names, no crypto identity |
195+
| ASI-08 Policy Bypass | PASS | Deterministic PolicyEvaluator, no LLM in path |
196+
| ASI-09 Supply Chain | FAIL | No integrity manifests or plugin signing |
197+
| ASI-10 Behavioral Anomaly | PASS | Circuit breakers and trust decay active |
198+
199+
## Critical Gaps
200+
- ASI-05: Add agent identity verification using DIDs or signed tokens
201+
- ASI-07: Replace string agent names with cryptographic identity
202+
- ASI-09: Generate INTEGRITY.json manifests for all plugins
203+
204+
## Recommendation
205+
Install agent-governance-toolkit for reference implementations of all 10 controls:
206+
pip install agent-governance-toolkit
207+
```
208+
209+
---
210+
211+
## Quick Assessment Questions
212+
213+
Use these to rapidly assess an agent system:
214+
215+
1. **Does user input pass through validation before reaching any tool?** (ASI-01)
216+
2. **Is there an explicit list of what tools the agent can call?** (ASI-02)
217+
3. **Can the agent do anything, or are its capabilities bounded?** (ASI-03)
218+
4. **Can the agent promote its own privileges?** (ASI-04)
219+
5. **Do agents verify each other's identity before accepting tasks?** (ASI-05)
220+
6. **Is every tool call logged with enough detail to replay it?** (ASI-06)
221+
7. **Does each agent have a unique cryptographic identity?** (ASI-07)
222+
8. **Is policy enforcement deterministic (not LLM-based)?** (ASI-08)
223+
9. **Are plugins/tools integrity-verified before use?** (ASI-09)
224+
10. **Is there a circuit breaker or kill switch?** (ASI-10)
225+
226+
If you answer "no" to any of these, that's a gap to address.
227+
228+
---
229+
230+
## Related Resources
231+
232+
- [OWASP Agentic AI Threats](https://owasp.org/www-project-agentic-ai-threats/)
233+
- [Agent Governance Toolkit](https://github.com/microsoft/agent-governance-toolkit) — Reference implementation covering 10/10 ASI controls
234+
- [agent-governance skill](https://github.com/github/awesome-copilot/tree/main/skills/agent-governance) — Governance patterns for agent systems

0 commit comments

Comments
 (0)