Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through anti-rationalization guards, self-critique loops, retry protocols, non-negotiable behaviors, self-reflection quality gates (1-10 scoring, ≥8 threshold), and a self-learning system with lesson/memory governance for security analysis agents.
agent-owasp-compliance
agent-owasp-compliance is an open-source security skill for Claude Code and compatible agents, published by github. Its author describes it as: “Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production deployment - Running a compliance ch…”. The project has 38k stars on GitHub and is available under the MIT license. Add it to your setup with `git clone https://github.com/github/awesome-copilot ~/.claude/skills/agent-owasp-compliance`.
What agent-owasp-compliance does
Evaluate AI agent systems against the OWASP Agentic Security Initiative (ASI) Top 10 — the industry standard for agent security posture.
Installation
Add agent-owasp-compliance to your agent with:
git clone https://github.com/github/awesome-copilot ~/.claude/skills/agent-owasp-complianceAlways review a skill's source before installing it. This command comes from the skill's public repository; the linked repo is the source of truth for exact setup steps.
What's inside
The SKILL.md for agent-owasp-compliance is organised into these sections:
- Overview
- The 10 Risks
- Check ASI-01: Prompt Injection Protection
- Check ASI-02: Insecure Tool Use
- Check ASI-03: Excessive Agency
- Check ASI-04: Unauthorized Escalation
- Check ASI-05: Trust Boundary Violation
- Check ASI-06: Insufficient Logging
- Check ASI-07: Insecure Identity
- Check ASI-08: Policy Bypass
- Check ASI-09: Supply Chain Integrity
- Check ASI-10: Behavioral Anomaly
When to use it
Reach for agent-owasp-compliance when you want security help from your agent without writing the same instructions every session. Load the skill and the agent picks it up automatically for relevant tasks.
Strengths
- Clear MIT license — safe to read and adapt
- Ships in github/awesome-copilot, an established project with 37,982 GitHub stars
- Actively maintained (recent commits)
Topics
Frequently asked questions
- What does agent-owasp-compliance do?
- Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production deployment - Running a compliance check against OWASP ASI 2026 standards - Mapping existing security controls to the 10 agentic risks - Generating a compliance report for security review or audit - Comparing agent framework security features against the standard - Any request like "is my agent OWASP compliant?", "check ASI compliance", or "agentic security audit"
- How do I install agent-owasp-compliance?
- Run git clone https://github.com/github/awesome-copilot ~/.claude/skills/agent-owasp-compliance in your agent, then reload your skills. Review the source at https://github.com/github/awesome-copilot before installing.
- Is agent-owasp-compliance free to use?
- Yes. agent-owasp-compliance is free and open source under the MIT license, so you can read, run, and adapt it within that license's terms.
- Where does agent-owasp-compliance come from?
- agent-owasp-compliance ships inside github/awesome-copilot, a repository that contains 41 catalogued skills in total. The repository's 37,982 GitHub stars apply to that whole collection, not to this skill on its own.
Related skills
More Security →
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
Use when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse. Covers MITRE ATLAS technique mapping, injection signature detection, and adversarial robustness scoring.
/cs:aims-audit <scope> — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit cycles, or when onboarding a new AI system into an existing AIMS.
Audits and designs iOS/macOS/watchOS/visionOS interfaces against the Apple Human Interface Guidelines, including the Liquid Glass design language (announced WWDC25, shipped with iOS 26/macOS Tahoe, Sept 2025). Use when reviewing an Apple-platform mockup or app for HIG compliance, checking contrast or tap-target sizes, or designing native-feeling Apple UI (e.g., 'audit my iOS app against the HIG', 'is this text readable on Liquid Glass?').