owasp-llm-top-10listed

# OWASP LLM Top 10 ## Purpose Provide a standardized, code-level lens for auditing LLM applications against the OWASP Top 10 for LLM Applications, so a security review of prompt construction and tool wiring is consistent and grounded in the source, not hand-waved. The recurring, highest-impact failure is **LLM01 prompt injection**: untrusted content (user text, retrieved documents, tool outputs, fetched web/email) is concatenated into a prompt and then read as instructions, driving the model, and any tool it can call, to do the attacker's bidding. This skill maps each risk to the code pattern that causes it, the mitigation, and a concrete attack to test with. ## The core mental model An LLM has no reliable boundary between "instructions" and "data." Everything in the context window is a candidate instruction. Security follows from three questions asked at every call site: 1. **Provenance**: is this text trusted (developer-authored) or untrusted (from a user, a document, a tool result, the web)? 2. **Capability**: what tools can the model call, and what can each tool do (read secrets? send data? mutate state?)? 3. **Reachability**: can untrusted text change the instructions in a way that reaches a dangerous capability? If untrusted text and a dangerous capability meet with nothing between them, you have an exploitable path. ## Risk-to-signal quick map | ID | Risk | Code-level signal | |---|---|---| | LLM01 | Prompt injection | Untrusted input interpolated into a prompt wi