llm-security by semgrep | skilld [Skip to main content](#main-content) [skilld](https://skilld.dev/) [Skills](https://skilld.dev/skills) [Collections](https://skilld.dev/collections) [Sign in](https://skilld.dev/login) [All skills](https://skilld.dev/skills) [![semgrep avatar](https://github.com/semgrep.png?size=96)semgrep/skills repository](https://skilld.dev/gh/semgrep/skills) # /llm-security official [semgrep](https://skilld.dev/gh/semgrep)/ [skills](https://skilld.dev/gh/semgrep/skills) 196 27 Security guidelines for LLM applications based on OWASP Top 10 for LLM 2025. Use when building LLM apps, reviewing AI security, implementing RAG systems, or asking about LLM vulnerabilities like 'prompt injection' or 'check LLM security'. IMPORTANT: Always consult this skill when building chatbots, AI agents, RAG pipelines, tool-using LLMs, agentic systems, or any application that calls an LLM API (OpenAI, Anthropic, Gemini, etc.) — even if the user doesn't explicitly mention security. Also use when users import 'openai', 'anthropic', 'langchain', 'llamaindex', or similar LLM libraries. 157/wk Updated 2 months ago [ Trust](#receipts "View trust signals: audits, signed commits, source provenance") [llm-security](https://skilld.dev/skills/tag/llm-security) [ prompt-injection](https://skilld.dev/skills/tag/prompt-injection) [ owasp](https://skilld.dev/skills/tag/owasp) [ rag](https://skilld.dev/skills/tag/rag) [ ai-agents](https://skilld.dev/skills/tag/ai-agents) [ data-poisoning](https://skilld.dev/skills/tag/data-poisoning) [ sensitive-disclosure](https://skilld.dev/skills/tag/sensitive-disclosure) [ output-handling](https://skilld.dev/skills/tag/output-handling) [ vector-embeddings](https://skilld.dev/skills/tag/vector-embeddings) ## Install skilld skills.sh `npx -y skilld add gh:semgrep/skills -s llm-security` [GitHub](https://github.com/semgrep/skills) [skills.sh](https://skills.sh/semgrep/llm-security) [Raw](https://skilld.dev/api/skills-raw/semgrep/skills/llm-security) ## Files - [SKILL.md](https://skilld.dev/gh/semgrep/skills/llm-security) ## Skill content Copy markdown Preview Raw ## LLM Security Guidelines (OWASP Top 10 for LLM 2025) Security rules for building secure LLM applications, based on the OWASP Top 10 for LLM Applications 2025. ### How to Use This Skill **Proactive mode** — When building or reviewing LLM applications, automatically check for relevant security risks based on the application pattern. You don't need to wait for the user to ask about LLM security. **Reactive mode** — When the user asks about LLM security, use the mapping below to find relevant rule files with detailed vulnerable/secure code examples. #### Workflow 1. Identify what the user is building (see "What Are You Building?" below) 2. Check the priority rules for that pattern 3. Read the specific rule files from `rules/` for code examples 4. Apply the secure patterns or flag vulnerable ones ### What Are You Building? Use this to quickly identify which rules matter most for the user's task: | Building... | Priority Rules | | --- | --- | | **Chatbot / conversational AI** | Prompt Injection (LLM01), System Prompt Leakage (LLM07), Output Handling (LLM05), Unbounded Consumption (LLM10) | | **RAG system** | Vector/Embedding Weaknesses (LLM08), Prompt Injection (LLM01), Sensitive Disclosure (LLM02), Misinformation (LLM09) | | **AI agent with tools** | Excessive Agency (LLM06), Prompt Injection (LLM01), Output Handling (LLM05), Sensitive Disclosure (LLM02) | | **Fine-tuning / training** | Data Poisoning (LLM04), Supply Chain (LLM03), Sensitive Disclosure (LLM02) | | **LLM-powered API** | Unbounded Consumption (LLM10), Prompt Injection (LLM01), Output Handling (LLM05), Sensitive Disclosure (LLM02) | | **Content generation** | Misinformation (LLM09), Output Handling (LLM05), Prompt Injection (LLM01) | ### Categories #### Critical Impact - **LLM01: Prompt Injection** ( `rules/prompt-injection.md`) - Prevent direct and indirect prompt manipulation - **LLM02: Sensitive Information Disclosure** ( `rules/sensitive-disclosure.md`) - Protect PII, credentials, and proprietary data - **LLM03: Supply Chain** ( `rules/supply-chain.md`) - Secure model sources, training data, and dependencies - **LLM04: Data and Model Poisoning** ( `rules/data-poisoning.md`) - Prevent training data manipulation and backdoors - **LLM05: Improper Output Handling** ( `rules/output-handling.md`) - Sanitize LLM outputs before downstream use #### High Impact - **LLM06: Excessive Agency** ( `rules/excessive-agency.md`) - Limit LLM permissions, functionality, and autonomy - **LLM07: System Prompt Leakage** ( `rules/system-prompt-leakage.md`) - Protect system prompts from disclosure - **LLM08: Vector and Embedding Weaknesses** ( `rules/vector-embedding.md`) - Secure RAG systems and embeddings - **LLM09: Misinformation** ( `rules/misinformation.md`) - Mitigate hallucinations and false outputs - **LLM10: Unbounded Consumption** ( `rules/unbounded-consumption.md`) - Prevent DoS, cost attacks, and model theft See `rules/_sections.md` for the full index with OWASP/MITRE references. ### Quick Reference | Vulnerability | Key Prevention | | --- | --- | | Prompt Injection | Input validation, output filtering, privilege separation | | Sensitive Disclosure | Data sanitization, access controls, encryption | | Supply Chain | Verify models, SBOM, trusted sources only | | Data Poisoning | Data validation, anomaly detection, sandboxing | | Output Handling | Treat LLM as untrusted, encode outputs, parameterize queries | | Excessive Agency | Least privilege, human-in-the-loop, minimize extensions | | System Prompt Leakage | No secrets in prompts, external guardrails | | Vector/Embedding | Access controls, data validation, monitoring | | Misinformation | RAG, fine-tuning, human oversight, cross-verification | | Unbounded Consumption | Rate limiting, input validation, resource monitoring | ### Key Principles 1. **Never trust LLM output** - Validate and sanitize all outputs before use 2. **Least privilege** - Grant minimum necessary permissions to LLM systems 3. **Defense in depth** - Layer multiple security controls 4. **Human oversight** - Require approval for high-impact actions 5. **Monitor and log** - Track all LLM interactions for anomaly detection ### References - [OWASP Top 10 for LLM Applications 2025](https://genai.owasp.org/llm-top-10/) - [MITRE ATLAS - Adversarial Threat Landscape for AI Systems](https://atlas.mitre.org/) - [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) Source: [SKILL.md on GitHub](https://github.com/semgrep/skills/blob/327da93b179157531853c5ec9e7f94bb4d3899ed/skills/llm-security/SKILL.md) ## What it does Provides security guidelines for LLM applications based on OWASP Top 10 for LLM 2025, covering prompt injection, sensitive disclosure, data poisoning, excessive agency, and other LLM-specific risks. Use when building chatbots, RAG systems, AI agents, or any application calling LLM APIs to identify relevant vulnerabilities and apply secure patterns. Generated from this skill's SKILL.md. ## Frequently asked
Does this skill cover prompt injection attacks? Yes. Prompt Injection (LLM01) is a critical category with dedicated rules for preventing both direct and indirect prompt manipulation in chatbots, RAG systems, and tool-using LLMs.
What LLM APIs and libraries does this apply to? This skill applies to any application calling OpenAI, Anthropic, Gemini, or similar LLM APIs, and to code using LangChain, LlamaIndex, or comparable LLM frameworks.
Should I use this skill only when the user explicitly asks about security? No. The skill is designed for proactive use: automatically check for relevant security risks whenever building or reviewing LLM applications, chatbots, RAG pipelines, or AI agents — regardless of whether the user mentions security.
Does this cover RAG system security? Yes. RAG systems have priority rules for Vector/Embedding Weaknesses (LLM08), Prompt Injection (LLM01), Sensitive Disclosure (LLM02), and Misinformation (LLM09).
Are there code examples for each vulnerability? Yes. Each of the 10 OWASP categories has a dedicated rule file in `rules/` with vulnerable and secure code examples.
Generated from the skill's SKILL.md. Refreshed when the source changes. ## Install skilld skills.sh `npx -y skilld add gh:semgrep/skills -s llm-security` [GitHub](https://github.com/semgrep/skills) [skills.sh](https://skills.sh/semgrep/llm-security) [Raw](https://skilld.dev/api/skills-raw/semgrep/skills/llm-security) ## Metadata
Description
593 chars · frontmatter
Frontmatter
2 keys
## Files - [SKILL.md](https://skilld.dev/gh/semgrep/skills/llm-security) ## Trust Verified 2 months ago · stale No third-party audits yet. Steady [327da93](https://github.com/semgrep/skills/commit/327da93b179157531853c5ec9e7f94bb4d3899ed "327da93b179157531853c5ec9e7f94bb4d3899ed")· updated 3 months ago [SKILL.md ](https://github.com/semgrep/skills/blob/327da93b179157531853c5ec9e7f94bb4d3899ed/skills/llm-security/SKILL.md) [ History ](https://github.com/semgrep/skills/commits/main/skills/llm-security/SKILL.md) ## Related skills From semgrep/skills [![semgrep avatar](https://github.com/semgrep.png?size=48) /code-security semgrep Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'. IMPORTANT: Always consult this skill when writing or reviewing any code that handles user input, authentication, file operations, database queries, network requests, cryptography, or infrastructure configuration (Terraform, Kubernetes, Docker, GitHub Actions) — even if the user doesn't explicitly mention security. Also use when users ask to 'review my code', 'check this for bugs', or 'is this safe'.](https://skilld.dev/gh/semgrep/skills/code-security) [![semgrep avatar](https://github.com/semgrep.png?size=48) /semgrep semgrep Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security vulnerabilities, write custom YAML rules, or detect specific bug patterns. IMPORTANT: Also use this skill when users ask to 'scan for bugs', 'check code quality', 'find vulnerabilities', 'static analysis', 'lint for security', 'audit this code', or want to enforce coding standards — even if they don't mention Semgrep by name. Semgrep is the right tool for pattern-based code scanning across 30+ languages.](https://skilld.dev/gh/semgrep/skills/semgrep) [Stats](https://skilld.dev/skills/stats) [Accessibility](https://skilld.dev/accessibility) [GitHub repository (opens in new tab)](https://github.com/harlan-zw/skilld) Built by [Harlan Wilton](https://harlanzw.com)